CVE-2022-30672: 
Adobe InDesign vulnerability analysis and mitigation

Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability identified as CVE-2022-30672. The vulnerability was discovered in mid-June 2022 and officially patched on September 13, 2022. This security flaw exists in the decoding of QuarkXPress Drawing 'QXD' files in Adobe InDesign (Adobe Security, Fortinet Research).

The vulnerability is classified as an out-of-bounds read vulnerability (CWE-125) that occurs specifically when processing malformed QXD files. The issue arises due to an improper bounds check during the file decoding process, which can lead to unauthorized memory access. This vulnerability has been rated as Important in severity (Fortinet Research).

When successfully exploited, this vulnerability could lead to the disclosure of sensitive memory information and potentially allow attackers to bypass security mitigations such as ASLR (Address Space Layout Randomization). The vulnerability affects both Windows users of Adobe InDesign 2022 version 17.3 and earlier, as well as Adobe InDesign 2021 version 16.4.2 and earlier (CVE Details).

Exploitation of this vulnerability requires user interaction, specifically the victim must open a maliciously crafted QXD file. Attackers can exploit this vulnerability to leak sensitive information within the context of the application via a crafted QXD file (Fortinet Research).

Fortinet has released an IPS signature named Adobe.InDesign.CVE-2022-30672.Memory.Leak to protect against this vulnerability. Additionally, Adobe has released security patches to address this issue, and users are strongly advised to update to the latest version of Adobe InDesign (Fortinet Research).