VulnerabilityModified

CVE-2020-9731

A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions).

HIGH 7.8EPSS 11.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 11.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-of-bounds memory access, potentially resulting in code execution in the context of the current user.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 11.29% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-788, CWE-787
Affected: adobe/indesign
Source: psirt@adobe.com

References

https://helpx.adobe.com/security/products/indesign/apsb20-52.htmlVendor Advisory
https://helpx.adobe.com/security/products/indesign/apsb20-52.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.