Arbitrary Code Execution Vulnerability in Substance3D Painter Could Lead to User Data Theft

CVE-2024-20741

Summary

The vulnerability in Adobe's Substance3D Painter, specifically in versions 9.1.1 and earlier, introduces a write-what-where condition. This flaw can be exploited to execute arbitrary code within the context of the current user session. The exploitation process requires user engagement, as it involves opening a specially crafted malicious file. As a result, users should exercise caution when handling unknown or untrusted files to mitigate potential risks associated with this vulnerability.

References