Lucene search

K
zdiMichael DePlante (@izobashi) of Trend Micro's Zero Day InitiativeZDI-23-300
HistoryMar 16, 2023 - 12:00 a.m.

Adobe Dimension USD File Parsing Uninitialized Pointer Information Disclosure Vulnerability

2023-03-1600:00:00
Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
www.zerodayinitiative.com
9
adobe dimension
usd files
pointer
information disclosure
vulnerability
remote attackers
sensitive information
user interaction
malicious page
malicious file
initialization
arbitrary code

EPSS

0.001

Percentile

51.4%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Dimension. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of USD files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

EPSS

0.001

Percentile

51.4%