CVE-2022-30674

MEDIUM

Adobe InDesign <= 16.4.2 and <= 17.3 - Out-of-bounds Read via Malicious File

Title source: llm

Description

Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

References (4)

Core 4

Core References

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/

Vendor Advisory

https://helpx.adobe.com/security/products/indesign/apsb22-50.html

Scores

CVSS v3 5.5

EPSS 0.0050

EPSS Percentile 38.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-125

Status published

Products (4)

adobe/indesign 16.0 - 16.4.2

fedoraproject/fedora 35

fedoraproject/fedora 36

fedoraproject/fedora 37

Published Sep 16, 2022

Tracked Since Feb 18, 2026