PT-2022-5424 · Adobe · Dimension

Published 2022-10-11 · Updated 2022-10-18 · CVE-2022-38446

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Dimension version 3.4.5

Description The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is associated with the analysis of SKP files in Adobe Dimension. Exploitation of this issue requires user interaction, where a victim must open a malicious file. The exploitation may allow an attacker to execute arbitrary code using a specially crafted file.

Recommendations For Adobe Dimension version 3.4.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2022-06750

CVE-2022-38446

ZDI-22-1439

Affected Products

Dimension

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-38446 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38446 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1439 · Security Note
• https://bdu.fstec.ru/vul/2022-06750 · Security Note
• https://helpx.adobe.com/security/products/dimension/apsb22-57.html · Vendor Advisory