ZDI-CAN-20313: Adobe Substance 3D Designer USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
CVE-2023-26409
7.8HIGH
Summary
Adobe Substance 3D Designer versions 12.4.0 and earlier are susceptible to an out-of-bounds read vulnerability. This security flaw occurs when the software processes a specially crafted file, potentially leading to a read beyond the limits of an allocated memory structure. Attackers can exploit this vulnerability to execute arbitrary code within the context of the user running the application. Notably, successful exploitation necessitates that the user open a malicious file, emphasizing the role of user interaction in this security threat.
Affected Version(s)
Substance3D - Designer <= 12.4.0
Substance3D - Designer <= unspecified
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved