CVE-2023-26385: ZDI-CAN-20267: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26385?
CVE-2023-26385 is rated as a critical severity vulnerability due to its potential for sensitive memory disclosure.
How do I fix CVE-2023-26385?
To fix CVE-2023-26385, users should update Adobe Substance 3D Stager to the latest version, following the vendor's security guidance.
Who is affected by CVE-2023-26385?
Users of Adobe Substance 3D Stager version 2.0.1 and earlier are affected by CVE-2023-26385.
What type of vulnerability is CVE-2023-26385?
CVE-2023-26385 is classified as an out-of-bounds read vulnerability.
Can exploitation of CVE-2023-26385 lead to remote attacks?
While CVE-2023-26385 primarily requires user interaction, exploitation could allow an attacker to bypass certain security mitigations.