ZDI-CAN-20258: Adobe Substance 3D Stager USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

CVE-2023-26389

Summary

Adobe Substance 3D Stager versions up to 2.0.1 are exposed to an out-of-bounds read vulnerability. This issue arises when the application processes a specially crafted file, allowing attackers to read data beyond the allocated memory limits. Successful exploitation demands user interaction, as the malicious file must be opened by the victim. This could lead to unintended code execution in the context of the current user, posing potential security risks and data exposure.

References