CVE-2024-41858: Adobe InCopy RCE Vulnerability

CVE-2024-41858 Overview

CVE-2024-41858 is an integer overflow vulnerability affecting Adobe InCopy versions 18.5.2, 19.4, and earlier. The flaw allows attackers to achieve arbitrary code execution in the context of the current user when a victim opens a crafted file. The vulnerability is categorized under [CWE-190] Integer Overflow or Wraparound and affects Adobe InCopy on both Microsoft Windows and Apple macOS platforms. Adobe published a fix in advisory APSB24-64.

Critical Impact
Successful exploitation results in arbitrary code execution with the privileges of the logged-in user, enabling attackers to install programs, modify data, or create new accounts.

Affected Products

Adobe InCopy versions 18.5.2 and earlier (18.x branch)
Adobe InCopy versions 19.4 and earlier (19.x branch)
Runs on Apple macOS and Microsoft Windows

Discovery Timeline

2024-08-14 - CVE-2024-41858 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41858

Vulnerability Analysis

The vulnerability stems from an integer overflow condition in Adobe InCopy's file parsing logic. When InCopy processes a malicious document, arithmetic operations on size or length fields wrap around, producing a smaller-than-expected value. Subsequent memory allocations or bounds checks rely on this truncated value, leading to undersized buffer allocations followed by out-of-bounds writes.

Attackers exploit the resulting memory corruption to redirect execution flow into attacker-controlled data. Because InCopy runs with the privileges of the current user, code execution inherits those permissions. The condition maps to [CWE-190] Integer Overflow or Wraparound.

Exploitation requires user interaction. A victim must open a crafted InCopy file delivered through phishing, shared network locations, or attacker-controlled downloads. The EPSS probability is 0.315% at percentile 24.269, indicating low observed exploitation activity to date.

Root Cause

The root cause is unchecked arithmetic during parsing of file structures. Values derived from attacker-controlled fields in the document are used in size calculations without validation against integer boundaries. The wraparound produces an allocation that cannot hold the data subsequently copied into it.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious InCopy file and delivers it to a target user. Opening the file in a vulnerable InCopy client triggers the integer overflow and subsequent memory corruption, resulting in code execution as the current user.

No verified public proof-of-concept exploit code has been published. Refer to the Adobe Security Advisory APSB24-64 for vendor technical details.

Detection Methods for CVE-2024-41858

Indicators of Compromise

Unexpected child processes spawned by InCopy.exe on Windows or Adobe InCopy on macOS, particularly command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
InCopy processes making outbound network connections to untrusted hosts shortly after opening a document.
Creation of executables or scripts in user-writable directories following an InCopy document open event.
InCopy document files (.icml, .indd, .incx) received from external sources via email or messaging platforms.

Detection Strategies

Monitor process creation events where InCopy is the parent process and correlate anomalous child processes with recent document opens.
Alert on InCopy writing files with executable extensions or performing DLL loads from non-standard paths.
Use YARA rules against file shares and mail gateways to identify InCopy documents containing malformed size fields.

Monitoring Recommendations

Enable command-line auditing (Windows Event ID 4688 with process command line, or AuditD on macOS/Linux) to capture InCopy process ancestry.
Forward endpoint telemetry to a central SIEM or data lake for correlation across users receiving similar InCopy documents.
Track InCopy version inventory to identify hosts still running 18.5.2, 19.4, or earlier.

How to Mitigate CVE-2024-41858

Immediate Actions Required

Update Adobe InCopy to the fixed versions listed in Adobe Security Advisory APSB24-64 on all Windows and macOS endpoints.
Identify hosts running vulnerable InCopy builds (18.5.2, 19.4, or earlier) and prioritize patching for users who handle external documents.
Instruct users to avoid opening InCopy files received from unverified sources until patching is complete.

Patch Information

Adobe released fixed versions of InCopy addressing CVE-2024-41858 in advisory APSB24-64 on August 13, 2024. Administrators should deploy the updated InCopy build through the Adobe Creative Cloud desktop application or through enterprise deployment tooling. Consult the vendor advisory for exact fixed version numbers per branch.

Workarounds

Restrict InCopy usage to trusted document sources through email gateway policies that quarantine InCopy files from external senders.
Apply application control policies (Windows Defender Application Control, AppLocker, or macOS profiles) to prevent InCopy from spawning shells or writing executables.
Run InCopy under standard user accounts rather than administrative accounts to limit the blast radius of exploitation.

bash

# Example: identify installed Adobe InCopy version on Windows
wmic product where "name like 'Adobe InCopy%%'" get name,version

# Example: identify installed Adobe InCopy version on macOS
mdls -name kMDItemVersion "/Applications/Adobe InCopy 2024/Adobe InCopy 2024.app"