CVE-2022-28824

Deeper analysis

Adobe FrameMaker versions 2019u8 and earlier as well as 2020u4 and earlier contain a use-after-free vulnerability tracked as CVE-2022-28824 and CWE-416. The flaw can be triggered when the application processes specially crafted input, leading to arbitrary code execution in the context of the current user. The issue carries a CVSS 3.0 base score of 7.8 reflecting local attack vector, low complexity, no required privileges, and required user interaction.

An attacker can exploit the vulnerability by supplying a malicious file that a victim must open in an affected version of FrameMaker. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the logged-in user, potentially resulting in full control over confidentiality, integrity, and availability of the affected system.

The official Adobe advisory APSB22-27, available at the referenced URL, addresses the issue and directs users to the corresponding product updates that remediate the use-after-free condition. The EPSS score for this CVE has remained flat at its recorded peak of 0.1143 with no material upward trajectory after disclosure.