ZDI-CAN-20364: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

CVE-2023-29281

What is CVE-2023-29281?

Adobe Substance 3D Painter versions 8.3.0 and prior contain an out-of-bounds read vulnerability that can be exploited when processing specially crafted files. This security flaw may allow an attacker to read beyond the intended memory boundaries, offering the potential for code execution in the context of the user. The successful exploitation of this vulnerability necessitates that the targeted user opens a maliciously designed file, highlighting the importance of caution when handling unknown file sources.

References