CVE-2021-45059 — Use After Free in Adobe Indesign

CWE-416 — Use After Free3 documents3 sources
Severity
3.3LOWNVD
EPSS
1.9%
top 16.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Adobe Indesign
Timeline
PublishedJan 13
Latest updateJan 14

Description

Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5adobe/indesignunspecified — 16.4+1
▶NVDadobe/indesign16.4

🔴Vulnerability Details

2
GHSA
GHSA-pc6m-5m68-4xr8: Adobe InDesign version 16↗2022-01-14
▶
CVEList
Adobe InDesign JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability↗2022-01-13
▶
CVE-2021-45059 — Use After Free in Adobe Indesign | cvebase