CVE-2022-28849: 
Adobe Bridge vulnerability analysis and mitigation

Adobe Bridge version 12.0.1 and earlier versions were affected by a Use-After-Free vulnerability (CVE-2022-28849) discovered in June 2022. The vulnerability specifically exists within the parsing of embedded fonts and could result in arbitrary code execution in the context of the current user. User interaction is required for exploitation, as a victim must open a malicious file (ZDI Advisory, NVD).

The vulnerability is classified as a Use-After-Free (CWE-416) issue that occurs during font parsing operations. The specific flaw exists due to the lack of validation for object existence prior to performing operations on the object. The vulnerability received a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, no privileges required, and user interaction required (NVD, ZDI Advisory).

If successfully exploited, this vulnerability could lead to arbitrary code execution in the context of the current user. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected system (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Bridge beyond version 12.0.1 (Adobe Advisory).