PT-2022-3003 · Adobe · Illustrator

Published 2022-06-14 · Updated 2023-09-09 · CVE-2022-30646

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Illustrator versions 26.0.2 and earlier Adobe Illustrator versions 25.4.5 and earlier

Description The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is also associated with insufficient input validation. Exploitation of this issue requires user interaction, where a victim must open a malicious file.

Recommendations For Adobe Illustrator versions 26.0.2 and earlier, update to a version later than 26.0.2 to resolve the issue. For Adobe Illustrator versions 25.4.5 and earlier, update to a version later than 25.4.5 to resolve the issue. As a temporary workaround, consider avoiding the use of untrusted or malicious files in Adobe Illustrator until a patch is available.

Fix

Memory Corruption

RCE

Weakness Enumeration

CWE-787

CWE-20

Related Identifiers

BDU:2022-03634

CVE-2022-30646

ZDI-22-822

Affected Products

Illustrator

References · 9

• https://helpx.adobe.com/security/products/illustrator/apsb22-26.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30646 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30646 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-822 · Security Note
• https://bdu.fstec.ru/vul/2022-03634 · Security Note
• https://t.me/cibsecurity/70094 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022061451 · Note
• https://twitter.com/cracbot/status/1700026260850978862 · Twitter Post
• https://twitter.com/CVEnew/status/1699779137387548921 · Twitter Post