CVE-2021-21050: 
Adobe Photoshop vulnerability analysis and mitigation

Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) were affected by an Out-of-bounds Read vulnerability (CVE-2021-21050) discovered in February 2021. The vulnerability was identified when parsing specially crafted U3D files, affecting both Windows and macOS operating systems (NVD, ZDI).

The vulnerability is an Out-of-bounds Read flaw that exists within the parsing of U3D files. The issue stems from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. The vulnerability received a CVSS v3.0 base score of 7.8 (High) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI).

Successful exploitation of this vulnerability could allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. The vulnerability requires user interaction, specifically requiring a victim to open a malicious file (NVD).

The vulnerability requires user interaction to be exploited, where the target must open a malicious file. The attack complexity is considered low, requiring no privileges but does need user interaction (ZDI).

Adobe has released security updates to address this vulnerability. Users should update to the latest version of Adobe Photoshop to protect against this vulnerability (Adobe Security).