CVE-2022-28819: 
Adobe Character Animator vulnerability analysis and mitigation

Adobe Character Animator versions 4.4.2 (and earlier) and 22.3 (and earlier) are affected by an out-of-bounds write vulnerability. The vulnerability was discovered on April 8, 2022, and publicly disclosed on May 10, 2022. This security flaw affects both Windows and macOS operating systems running the specified versions of Adobe Character Animator (Adobe Advisory, ZDI Advisory).

The vulnerability is classified as an out-of-bounds write (CWE-787) that occurs during the parsing of SVG images. The flaw allows crafted data in an SVG image to trigger a write past the end of an allocated buffer. The vulnerability has received a CVSS v3.0 base score of 7.8 (High) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and a CVSS v2.0 score of 9.3 (ZDI Advisory, Adobe Advisory).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the current user. This means an attacker could potentially execute malicious code with the same privileges as the user running the Adobe Character Animator application (Adobe Advisory).

Exploitation of this vulnerability requires user interaction, specifically the victim must open a malicious SVG file. The attack vector is considered local (AV:L), with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R) (ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users should update their Adobe Character Animator installations to versions newer than 4.4.2 or 22.3 to mitigate this security risk (Adobe Advisory).

The vulnerability was initially reported to Adobe by Mat Powell working with Trend Micro Zero Day Initiative on February 2, 2022, leading to a coordinated public release on May 10, 2022 (ZDI Advisory).