CVE-2023-26368
📋 TL;DR
Adobe InCopy has an out-of-bounds read vulnerability that could allow arbitrary code execution when a user opens a malicious file. Attackers could exploit this to run code with the victim's privileges. Users of Adobe InCopy versions 18.5 and earlier or 17.4.2 and earlier are affected.
💻 Affected Systems
- Adobe InCopy
📦 What is this software?
Incopy by Adobe
Incopy by Adobe
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with current user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Limited code execution leading to data exfiltration or malware installation on the affected workstation.
If Mitigated
No impact if users don't open untrusted files or if application is patched.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and bypassing memory protections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.5.1 or 17.4.3
Vendor Advisory: https://helpx.adobe.com/security/products/incopy/apsb23-60.html
Restart Required: Yes
Instructions:
1. Open Adobe InCopy. 2. Go to Help > Check for Updates. 3. Follow prompts to install update. 4. Restart application.
🔧 Temporary Workarounds
Restrict file opening
allConfigure application to only open trusted files or disable automatic opening of InCopy documents.
Application control
allUse application whitelisting to prevent execution of malicious code.
🧯 If You Can't Patch
- Implement strict email filtering to block malicious attachments
- Educate users to never open untrusted InCopy files from unknown sources
🔍 How to Verify
Check if Vulnerable:
Check Adobe InCopy version via Help > About Adobe InCopy. If version is 18.5 or earlier, or 17.4.2 or earlier, system is vulnerable.Check Version:
On Windows: wmic product where name="Adobe InCopy" get version
On macOS: /Applications/Adobe\ InCopy\ 2023/Adobe\ InCopy\ 2023.app/Contents/MacOS/Adobe\ InCopy\ 2023 --versionVerify Fix Applied:
Verify version is 18.5.1 or higher, or 17.4.3 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected file opening events
Network Indicators:
- Unusual outbound connections after opening InCopy files
SIEM Query:
source="*incopy*" AND (event_type="crash" OR file_path="*.inc*" AND user_action="open")