Out-of-bounds write in Adobe Photoshop - CVE-2018-4946
Published: May 15, 2018
Vulnerability identifier: #VU12654
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-4946
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an error when parsing malicious files. A remote unauthenticated attacker can trick the victim into opening a specially crafted input, trigger out-of-bounds write and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in system compromise.
Affected software
Adobe Photoshop
Adobe Reader
Adobe Acrobat
Adobe Reader
Adobe Acrobat
How to mitigate CVE-2018-4946
Update to version 18.1.4, 19.1.4.