CVE-2023-47058
📋 TL;DR
Adobe Premiere Pro versions 24.0 and earlier, and 23.6 and earlier, contain an out-of-bounds read vulnerability when parsing malicious files. An attacker can exploit this to execute arbitrary code with the victim's user privileges. Users who open untrusted Premiere Pro project files are at risk.
💻 Affected Systems
- Adobe Premiere Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution, allowing attacker to install malware, steal data, or pivot to other systems.
Likely Case
Local privilege escalation leading to data theft, ransomware deployment, or persistence establishment on the victim's workstation.
If Mitigated
Application crash or denial of service if memory protections prevent code execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and bypassing memory protections like ASLR/DEP.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.1 and 23.7
Vendor Advisory: https://helpx.adobe.com/security/products/premiere_pro/apsb23-65.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application. 2. Navigate to 'Apps' tab. 3. Find Premiere Pro and click 'Update'. 4. Restart Premiere Pro after update completes.
🔧 Temporary Workarounds
Restrict file opening
allConfigure Premiere Pro to only open trusted project files from known sources.
Application control
windowsUse application whitelisting to prevent execution of unauthorized code from Premiere Pro memory space.
🧯 If You Can't Patch
- Discontinue use of Premiere Pro for untrusted project files.
- Run Premiere Pro in a sandboxed or isolated environment.
🔍 How to Verify
Check if Vulnerable:
Check Premiere Pro version via Help > About Premiere Pro. If version is 24.0 or earlier, or 23.6 or earlier, it's vulnerable.Check Version:
On Windows: wmic product where name="Adobe Premiere Pro" get version. On macOS: /Applications/Adobe\ Premiere\ Pro\ */Adobe\ Premiere\ Pro.app/Contents/Info.plist | grep -A1 CFBundleShortVersionStringVerify Fix Applied:
Verify version is 24.1 or later, or 23.7 or later after updating.📡 Detection & Monitoring
Log Indicators:
- Premiere Pro crash logs with memory access violations
- Unexpected child processes spawned from Premiere Pro
Network Indicators:
- Unusual outbound connections from Premiere Pro process
SIEM Query:
process_name:"Adobe Premiere Pro.exe" AND (event_id:1000 OR event_id:1001) AND exception_code:0xc0000005