Arbitrary Code Execution Vulnerability in Substance3D Painter Could Lead to User Data Theft
CVE-2024-30274

7.8HIGH

Key Information:

Vendor

Adobe
Status
Substance3d - Painter
Vendor
CVE Published:
16 May 2024

What is CVE-2024-30274?

Substance3D Painter versions 9.1.2 and earlier are susceptible to an out-of-bounds write vulnerability that could allow an attacker to execute arbitrary code on the affected system. This issue arises when a victim interacts with a malicious file, which could lead to the execution of harmful operations in the context of the current user. User awareness and incident response strategies are essential to mitigate the risks associated with this vulnerability.

Affected Version(s)

Substance3D - Painter 0 <= 9.1.2

References

https://helpx.adobe.com/security/products/substance3d_pai...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-30274 : Arbitrary Code Execution Vulnerability in Substance3D Painter Could Lead to User Data Theft