CVE-2022-38434

Deeper analysis

Adobe Photoshop versions 22.5.8 and earlier as well as 23.4.2 and earlier contain a Use After Free vulnerability tracked as CVE-2022-38434. The flaw is assigned CWE-416 and carries a CVSS 3.1 score of 7.8, reflecting local attack vector, low complexity, no required privileges, and required user interaction. Successful exploitation can yield arbitrary code execution in the context of the current user.

An attacker can trigger the issue by supplying a malicious file that the victim must open in an affected Photoshop installation. Because the vulnerability is local and requires user interaction, the attacker needs no prior access to the target system beyond the ability to deliver the crafted file.

The referenced Adobe security advisory APSB22-52 describes the affected releases and provides remediation guidance, including updated Photoshop builds that address the use-after-free condition.

EPSS for the CVE rose from a low baseline to a peak of 0.0731 on 2025-01-22 before receding to the current value of 0.0032, indicating that exploitation interest emerged well after initial disclosure.