CVE-2024-47440: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

Adobe Substance 3D Painter versions 10.1.0 and earlier are affected by an out-of-bounds read vulnerability (CVE-2024-47440). The vulnerability was disclosed on November 12, 2024, and affects the core functionality of the software (NVD, Adobe Advisory).

The vulnerability is classified as an out-of-bounds read issue (CWE-125) that could potentially lead to disclosure of sensitive memory. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.5 (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). This indicates that while the vulnerability requires local access and user interaction, it could result in high confidentiality impact (NVD).

The vulnerability could lead to the disclosure of sensitive memory contents and potentially allow attackers to bypass security mitigations such as ASLR (Address Space Layout Randomization). The exploitation requires user interaction, specifically opening a malicious file (CIS Advisory).

Adobe has released version 10.1.1 of Substance 3D Painter to address this vulnerability. Users are advised to update to the latest version immediately after appropriate testing (Adobe Advisory).