CVE-2023-26398: ZDI-CAN-20310: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26398?
The intensity of CVE-2023-26398 is categorized as high due to the potential for code execution by an attacker.
How do I fix CVE-2023-26398?
To remediate CVE-2023-26398, update Adobe Substance 3D Designer to version 12.4.1 or later.
What types of systems are affected by CVE-2023-26398?
CVE-2023-26398 specifically affects Adobe Substance 3D Designer version 12.4.0 and earlier.
What can an attacker achieve by exploiting CVE-2023-26398?
An attacker exploiting CVE-2023-26398 could execute arbitrary code by leveraging the out-of-bounds read vulnerability.
Is there a workaround for CVE-2023-26398?
Currently, there are no known workarounds for CVE-2023-26398; updating to the latest version is advised.