PT-2024-8021 · Adobe · Substance3D - Painter
Published
2024-11-12
·
Updated
2024-11-13
·
CVE-2024-47438
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Substance3D - Painter versions 10.1.0 and earlier
Description:
The issue is related to a Write-what-where Condition that could lead to a memory leak, allowing an attacker to write a controlled value at a controlled memory location. This could result in the disclosure of sensitive memory content. Exploitation requires user interaction, where a victim must open a malicious file. The vulnerability may also be associated with a buffer overflow, potentially allowing an attacker to gain unauthorized access to protected information using a specially crafted file.
Recommendations:
For Substance3D - Painter versions 10.1.0 and earlier, update to a version later than 10.1.0 to resolve the issue.
As a temporary workaround, consider avoiding the use of potentially malicious files until a patch is available.
Restrict access to sensitive information and ensure that only trusted files are opened with the affected software to minimize the risk of exploitation.
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Substance3D - Painter