CVE-2022-30654
Published: 16 June 2022
Summary
CVE-2022-30654 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Incopy. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe InCopy versions 17.2 and earlier along with 16.4.1 and earlier are affected by a heap-based buffer overflow vulnerability that can result in arbitrary code execution. The flaw is identified as CVE-2022-30654 and is associated with CWE-122 and CWE-787; it carries a CVSS 3.0 score of 7.8 reflecting local attack vector, low attack complexity, and no privileges required.
An attacker can exploit the issue by crafting a malicious file and convincing a target user to open it, after which code executes in the context of that user. No remote vector or elevated privileges are needed, but user interaction is mandatory.
The referenced Adobe security bulletin APSB22-29 describes the available patches and urges customers to update affected InCopy installations to the fixed releases as the primary mitigation.
EPSS remains flat at 0.0636 with no material rise from its initial value, providing no indication of growing exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-52485
Vulnerability details
Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…
more
that a victim must open a malicious file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.