A vulnerability has been found in Adobe Media Encoder up to 14.3.2 and classified as critical. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Adobe Media Encoder version 14.3.2 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer, possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The weakness was presented 09/18/2020 as APSB20-57 as confirmed security bulletin (Website). It is possible to read the advisory at helpx.adobe.com. This vulnerability is known as CVE-2020-9745 since 03/02/2020. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading eliminates this vulnerability.

See 161561 and 161562 for similar entries.

Productinfo

Vendor

• Adobe

Name

• Media Encoder

Version

• 14.3.0
• 14.3.1
• 14.3.2

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion