CVE-2021-45054 — Use After Free in Adobe Incopy

CWE-416 — Use After Free3 documents3 sources
Severity
5.5MEDIUMNVD
CNA3.3
EPSS
1.6%
top 18.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Adobe Incopy
Timeline
PublishedJan 13
Latest updateJan 14

Description

Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5adobe/incopyunspecified — 16.4+1
▶NVDadobe/incopy16.4

🔴Vulnerability Details

2
GHSA
GHSA-h6g9-9vqr-2wj7: Adobe InCopy version 16↗2022-01-14
▶
CVEList
Adobe InCopy JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability↗2022-01-13
▶
CVE-2021-45054 — Use After Free in Adobe Incopy | cvebase