ZDI-CAN-20371: Adobe Substance 3D Painter GLTF File Parsing Uninitialized Variable Information Disclosure Vulnerability

CVE-2023-29278

Summary

Adobe Substance 3D Painter versions 8.3.0 and earlier are susceptible to an Access of Uninitialized Pointer vulnerability. This issue can lead to arbitrary code execution within the context of the current user. Successful exploitation necessitates user interaction, as a user must open a specially-crafted malicious file. Users are advised to avoid opening unknown files and to ensure their software is up to date to mitigate potential risks. For further details, visit the Adobe security advisory.

References