ZDI-CAN-20367: Adobe Substance 3D Painter USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

CVE-2023-29273

Summary

Adobe Substance 3D Painter versions 8.3.0 and earlier contain an out-of-bounds read vulnerability that occurs when the application processes specially crafted files. This flaw could enable attackers to read memory beyond the intended bounds, potentially leading to the execution of arbitrary code within the context of the current user. Successful exploitation necessitates user interaction; victims must open a deliberately malcrafted file to trigger the vulnerability. Users of affected versions should ensure they apply the necessary updates to mitigate this security risk.

References