Arbitrary Code Execution Vulnerability in Substance3D Painter Could Lead to User Data Theft

CVE-2024-20740

Summary

An out-of-bounds write vulnerability has been identified in Adobe Substance3D Painter versions 9.1.1 and earlier, potentially leading to arbitrary code execution within the context of the current user. Exploitation of this vulnerability necessitates user interaction, as the victim must open a specifically crafted malicious file. This highlights the importance of cautious file handling practices and maintaining updated software versions to mitigate risks associated with such vulnerabilities.

References