CVE-2022-30650
Published: 16 June 2022
Summary
CVE-2022-30650 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Incopy. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe InCopy versions 17.2 and earlier as well as 16.4.1 and earlier contain a heap-based buffer overflow vulnerability tracked as CVE-2022-30650. The flaw, assigned CWE-122 and CWE-787, can be triggered when the application processes a specially crafted file and may allow arbitrary code execution in the context of the current user. The issue carries a CVSS 3.0 base score of 7.8 with an attack vector of local access, low attack complexity, no privileges required, and required user interaction.
An attacker can exploit the vulnerability by supplying a malicious file that a victim must open in the affected InCopy release. Successful exploitation grants the attacker the ability to execute arbitrary code under the privileges of the user who opened the file, potentially leading to full compromise of the affected system.
The official Adobe security advisory APSB22-29, published alongside the CVE, directs users to apply the vendor-supplied updates that remediate the buffer overflow in the listed InCopy versions. The EPSS score for this CVE has remained flat at 0.0636 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-52481
Vulnerability details
Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…
more
that a victim must open a malicious file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.