CVE-2023-25907

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Adobe Dimension versions 3.4.7 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Mar 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-259087.8Adobe Photoshop versions 23.5.3 (and earlier) and 24.1.1 (and earlier) are affected by a Use After Free vulnerability that could result in aCVE-2023-259099.8HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit CVE-2023-25915.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to CVE-2023-259108.8A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7CVE-2023-259118.8The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parametersCVE-2023-259125.3The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive infoCVE-2023-259137.5Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as interCVE-2023-259148.8Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interfaceCVE-2023-259158.8Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system.CVE-2023-25927.2The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading toCVE-2023-259218.8IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous typCVE-2023-259228.8IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous typ
CVE-2023-25907: High severity, CVSS 7.8 | Vulnix