CVE-2022-30657

Deeper analysis

Adobe InCopy versions 17.2 and earlier as well as 16.4.1 and earlier contain a use-after-free flaw (CWE-416) that can be triggered when the application processes a specially crafted file. The vulnerability carries a CVSS 3.0 base score of 7.8 and allows arbitrary code execution in the context of the current user when successfully exploited.

An attacker can deliver a malicious InCopy document to a target and rely on the victim to open it. Because the attack vector is local and requires user interaction, no authentication or elevated privileges are needed, yet successful exploitation yields full control over the affected process, including the ability to read, modify, or delete data and execute additional payloads.

Adobe has published security advisory APSB22-29 that addresses the issue and provides updated builds for the affected InCopy releases. The associated EPSS score has remained near 0.11 with negligible movement between its recorded peak and current value, indicating limited observed exploitation interest since disclosure.