CVE-2024-20745: 
Adobe Premiere Pro vulnerability analysis and mitigation

CVE-2024-20745 is a Heap-based Buffer Overflow vulnerability affecting Adobe Premiere Pro versions 24.1, 23.6.2 and earlier. The vulnerability was discovered and reported to Adobe on December 6, 2023, and was publicly disclosed on March 12, 2024. This security flaw affects Adobe Premiere Pro installations on both Windows and macOS operating systems (NVD, Adobe Advisory).

The vulnerability exists within the parsing of AVI files and results from improper validation of user-supplied data length before copying it to a fixed-length heap-based buffer. It has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-122 (Heap-based Buffer Overflow) (ZDI Advisory, Adobe Advisory).

Successful exploitation of this vulnerability could result in arbitrary code execution in the context of the current user. An attacker could potentially install programs, view, change, or delete data, or create new accounts with full user rights, depending on the user's privileges (CIS Advisory).

Exploitation of this vulnerability requires user interaction, specifically the target must open a malicious file. As of March 2024, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Premiere Pro installations to versions 23.6.4 or 24.2.1 or later. Organizations are recommended to apply the stable channel update provided by Adobe to vulnerable systems immediately after appropriate testing (Adobe Advisory).