ZDI-CAN-20236: Adobe Substance 3D Stager USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-26394

Summary

A vulnerability in Adobe Substance 3D Stager versions 2.0.1 and earlier allows for a heap-based buffer overflow, potentially leading to arbitrary code execution. Exploitation of this vulnerability requires user interaction; a victim must open a specially crafted file that triggers the overflow in the application. This can compromise the system in the context of the current user, posing significant security risks.

References