PT-2021-7648 · Adobe · After Effects

Published 2021-12-14 · Updated 2023-02-24 · CVE-2023-22239

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions After Effects versions 23.1 and earlier After Effects versions 22.6.3 and earlier

Description The issue is related to improper input validation, which could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file. The vulnerability is also described as a font parsing memory corruption remote code execution issue.

Recommendations For versions 23.1 and earlier, update to a version that fixes the improper input validation vulnerability. For versions 22.6.3 and earlier, update to a version that fixes the improper input validation vulnerability. As a temporary workaround, consider avoiding the use of potentially malicious files until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-00820

CVE-2023-22239

ZDI-23-147

Affected Products

After Effects

References · 7

• https://osv.dev/vulnerability/CVE-2023-22239 · Vendor Advisory
• https://helpx.adobe.com/security/products/after_effects/apsb23-02.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-147 · Security Note
• https://bdu.fstec.ru/vul/2023-00820 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22239 · Security Note
• https://t.me/cvenotify/44614 · Telegram Post
• https://t.me/cibsecurity/58479 · Telegram Post