CVE-2023-26398: 
Adobe Substance 3D Designer vulnerability analysis and mitigation

Adobe Substance 3D Designer version 12.4.0 and earlier versions contain an out-of-bounds read vulnerability that was discovered and disclosed in April 2023. The vulnerability affects Adobe Substance 3D Designer software running on both Windows and macOS operating systems (NVD).

The vulnerability is classified as an out-of-bounds read issue (CWE-125) that occurs when parsing crafted files. This could result in reading past the end of an allocated memory structure. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute code in the context of the current user. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires user interaction for successful exploitation, specifically requiring a victim to open a malicious file. The attack complexity is considered low, but local access is required (NVD).

Adobe has addressed this vulnerability in an update. Users of Adobe Substance 3D Designer should ensure they are running a version newer than 12.4.0 (Adobe Advisory).