ZDI-CAN-20234: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

CVE-2023-26393

Summary

Adobe Substance 3D Stager, specifically version 2.0.1 and earlier, contains an out-of-bounds read vulnerability that occurs during the parsing of specially crafted files. This issue enables attackers to read data beyond the allocated memory structure. Successful exploitation requires the user to open a malicious file, potentially allowing an attacker to execute arbitrary code in the context of the current user's privileges, posing significant risks to system security.

References