CVE-2022-23188
Published: 16 February 2022
Summary
CVE-2022-23188 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Adobe Illustrator. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe Illustrator versions 25.4.3 and earlier, as well as 26.0.2 and earlier, contain a buffer overflow vulnerability tracked as CVE-2022-23188 and assigned CWE-120. The flaw stems from insecure handling of a crafted malicious file and carries a CVSS 3.1 score of 7.8, reflecting local attack vector, low attack complexity, and no required privileges.
An attacker can exploit the issue by supplying a malicious file that a victim opens in Illustrator. Successful exploitation grants arbitrary code execution in the context of the current user; the attack requires user interaction and cannot be triggered remotely without that step.
Adobe has published advisory APSB22-07, which addresses the vulnerability and provides mitigation guidance including software updates for the affected Illustrator releases.
The associated EPSS score has remained flat at 0.0568 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28278
Vulnerability details
Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted malicious file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation…
more
requires user interaction in that a victim must open a crafted malicious file in Illustrator.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.