Apple MACOS

ZDI-CAN-20237: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI-CAN-20313: Adobe Substance 3D Designer USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI-CAN-20312: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Adobe Acrobat Pro DC Use-After-Free Remote Code Execution Vulnerability

Animate | Out-of-bounds Write (CWE-787)

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges.

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox.

Acrobat Reader | Use After Free (CWE-416)

Adobe InCopy Improper Input Validation Remote Code Execution Vulnerability

ZDI-CAN-21078: Adobe Dimension GLB File Parsing Use-After-Free Remote Code Execution Vulnerability

ZDI-CAN-20217: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI-CAN-20145: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI-CAN-20144: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe InCopy Out-of-Bounds Read Vulnerability v1.0

Adobe After Effects TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe After Effects 3GP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Substance3D - Stager | Heap-based Buffer Overflow (CWE-122)

Media Encoder | Out-of-bounds Write (CWE-787)

Adobe Indesign TIF File Parsing Heap Memory Corruption

Substance3D - Stager | Heap-based Buffer Overflow (CWE-122)

Illustrator | Heap-based Buffer Overflow (CWE-122)

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.

ZDI-CAN-21685: Adobe Audition MP4 File Parsing Uninitialized Variable Remote Code Execution Vulnerability

Adobe Photoshop JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Illustrator 2024 BMP File Parsing Memory Corruption

InCopy | Integer Underflow (Wrap or Wraparound) (CWE-191)

ZDI-CAN-22172: Adobe After Effects AEP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Acrobat Reader | Heap-based Buffer Overflow (CWE-122)

InCopy | Stack-based Buffer Overflow (CWE-121)

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious NFS server may lead to arbitrary code execution with kernel privileges.

Acrobat Reader | Stack-based Buffer Overflow (CWE-121)

InDesign Desktop | Stack-based Buffer Overflow (CWE-121)

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

Acrobat Reader | Heap-based Buffer Overflow (CWE-122)

Bridge | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

Bridge | Heap-based Buffer Overflow (CWE-122)

Acrobat Reader | Heap-based Buffer Overflow (CWE-122)

Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)