CVE-2022-28846
Published: 15 June 2022
Summary
CVE-2022-28846 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Bridge. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 9.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe Bridge version 12.0.1 and earlier versions are affected by an out-of-bounds write vulnerability, identified as CVE-2022-28846 and assigned CWE-787. The flaw carries a CVSS 3.0 score of 7.8 and can result in arbitrary code execution in the context of the current user when triggered.
An attacker can exploit the issue by supplying a malicious file that a victim must open. Successful exploitation grants the attacker the ability to run arbitrary code locally without requiring elevated privileges, though user interaction is mandatory.
The official Adobe advisory at https://helpx.adobe.com/security/products/bridge/apsb22-25.html addresses mitigation steps and available patches for the affected Bridge releases. The associated EPSS score has remained flat at 0.0542 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-33283
Vulnerability details
Adobe Bridge version 12.0.1 (and earlier versions) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.