Vulnerability · Published Jul 9, 2024 · Assigned by adobe

CVE-2024-34123Adobe Premiere Pro arbitrary DLL loading lead to remote code execution

High 7.0

In plain English

A high-severity security flaw in Premiere Pro from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.3%top 76.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Premiere Pro versions 23.6.5, 24.4.1 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious file into the search path, which the application might execute instead of the legitimate file. This could occur when the application uses a search path to locate executables or libraries. Exploitation of this issue requires user interaction, attack complexity is high.

Affected products (as reported)

Vendor	Product	Versions
Adobe	Premiere Pro	0 – through 24.4.1

Weakness: CWE-426 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://helpx.adobe.com/security/products/premiere_pro/apsb24-46.html vendor-advisory