CVE-2022-28823
Published: 13 May 2022
Summary
CVE-2022-28823 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Framemaker. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe FrameMaker versions 2029u8 and earlier as well as 2020u4 and earlier contain a use-after-free vulnerability tracked as CWE-416. The flaw carries a CVSS 3.0 base score of 7.8 and can result in arbitrary code execution in the context of the current user when a malicious file is processed.
An attacker can exploit the issue by supplying a crafted document that triggers the use-after-free condition. Successful exploitation requires the victim to open the file, after which the attacker gains the ability to execute arbitrary code with the privileges of the logged-in user.
Adobe has published security advisory APSB22-27 at https://helpx.adobe.com/security/products/framemaker/apsb22-27.html that addresses the vulnerability and supplies remediation guidance for supported releases. The associated EPSS score has remained flat at a peak of 0.1143 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-33260
Vulnerability details
Adobe Framemaker versions 2029u8 (and earlier) and 2020u4 (and earlier) are affected by a Use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…
more
victim must open a malicious file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.