ZDI-CAN-20313: Adobe Substance 3D Designer USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

CVE-2023-26409

What is CVE-2023-26409?

Adobe Substance 3D Designer versions 12.4.0 and earlier are susceptible to an out-of-bounds read vulnerability. This security flaw occurs when the software processes a specially crafted file, potentially leading to a read beyond the limits of an allocated memory structure. Attackers can exploit this vulnerability to execute arbitrary code within the context of the user running the application. Notably, successful exploitation necessitates that the user open a malicious file, emphasizing the role of user interaction in this security threat.

References