PT-2023-1837 · Adobe · Substance3D - Stager

Published 2023-03-14 · Updated 2023-04-03 · CVE-2023-25872

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Substance 3D Stager versions 2.0.0 and earlier

Description The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, where a victim must open a malicious file. This allows an attacker to potentially execute arbitrary code using a specially crafted file.

Recommendations For Adobe Substance 3D Stager versions 2.0.0 and earlier, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of SVG files from untrusted sources to minimize the risk of exploitation. Restrict access to potentially malicious files to prevent the execution of arbitrary code.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2023-01435

CVE-2023-25872

ZDI-23-265

Affected Products

Substance3D - Stager

References · 6

• https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-265 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25872 · Security Note
• https://bdu.fstec.ru/vul/2023-01435 · Security Note
• https://cybersecurity-help.cz/vdb/SB2023031454 · Note