Apple MACOS

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.

ZDI-CAN-21697: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

TCC Bypass via Inherited Permissions in Bundled Interpreter in GIMP.app

Bridge | Integer Underflow (Wrap or Wraparound) (CWE-191)

Bridge | Access of Uninitialized Pointer (CWE-824)

Adobe Premiere Elements Uncontrolled Search Path Element Privilege Escalation

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to cause unexpected system termination or corrupt kernel memory.

Adobe Photoshop Improper Input Validation Remote Code Execution Vulnerability

Adobe InDesign Improper Input Validation Remote Code Execution Vulnerability

Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.5. A local attacker may be able to execute code on the Apple T2 Security Chip.

Adobe Bridge Improper Input Validation Remote Code Execution Vulnerability

ZDI-CAN-20286: Adobe Substance 3D Stager USDZ File Parsing Memory Corruption Remote Code Execution Vulnerability

When Animate parses FLA files, there is an out-of-bounds write vulnerability at animate+0x123df28

When Adobe Animate parses FLA files, there is a heap out-of-bounds write vulnerability at Animate.exe+0x125D391

Acrobat Reader | Out-of-bounds Read (CWE-125)

This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5. An app may be able to gain root privileges.

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to break out of its sandbox.

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app may cause unexpected app termination or arbitrary code execution.

After Effects | Heap-based Buffer Overflow (CWE-122)

After Effects | Out-of-bounds Write (CWE-787)

A local attacker may be able to elevate their privileges. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A memory corruption issue was addressed with improved validation.

A validation issue was addressed with improved logic. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to execute arbitrary code with kernel privileges.

After Effects | Out-of-bounds Write (CWE-787)

After Effects | Out-of-bounds Write (CWE-787)

Photoshop Desktop | Out-of-bounds Write (CWE-787)

Photoshop Desktop | Out-of-bounds Write (CWE-787)

Acrobat Reader | Access of Uninitialized Pointer (CWE-824)

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

Adobe Illustrator Improper Input Validation Remote Code Execution Vulnerability

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. An application may be able to gain elevated privileges.

Illustrator | Out-of-bounds Write (CWE-787)

Code injection in Nextcloud Desktop Client for macOS

ZDI-CAN-21764: Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI-CAN-19412: Adobe Dimension GLTF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI-CAN-20031: Adobe Dimension OBJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI-CAN-20212: Adobe Dimension USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privileges.

The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.