CVE-2021-45054 LOW

CVE-2021-45054: Adobe InCopy JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability

Vendor Adobe
Product InCopy
Weakness CWE-416
Published January 13, 2022
Last update April 23, 2025

CVSS base score

3.3/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Key dates

02Disclosure timeline

January 13, 2022 CVE published
April 23, 2025 Record updated