CVE-2020-9683: 
Adobe Photoshop vulnerability analysis and mitigation

Adobe Photoshop versions CC 2019 and Photoshop 2020 were found to contain an out-of-bounds read vulnerability identified as CVE-2020-9683. The vulnerability was disclosed on July 21, 2020, and affects Photoshop CC 2019 versions 20.0.9 and earlier, as well as Photoshop 2020 21.2 and earlier versions on Windows systems (Threatpost, NVD).

The vulnerability is classified as an out-of-bounds read issue (CWE-125) with a CVSS v3.1 base score of 8.8 (HIGH). The vulnerability features a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and user interaction required for exploitation (NVD).

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current user, potentially allowing attackers to execute malicious code on targeted Windows devices (Threatpost).

At the time of disclosure, Adobe stated that there were no known exploits of this vulnerability in the wild (Threatpost).

Adobe released patches to address this vulnerability. Users of Photoshop CC 2019 should update to version 20.0.10, while Photoshop 2020 users should update to version 21.2.1 (Threatpost).

The vulnerability was discovered and reported by Mat Powell from Trend Micro's Zero Day Initiative. Adobe addressed this vulnerability as part of an out-of-band security update, which was notable as it came just a week after Adobe's official July 2020 security updates (Threatpost).