CVE-2024-49519: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

Adobe Substance 3D Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability identified as CVE-2024-49519. The vulnerability was disclosed on November 12, 2024, and requires user interaction through opening a malicious file to be exploited (NVD).

The vulnerability is classified as an out-of-bounds write issue (CWE-787) that could lead to arbitrary code execution in the context of the current user. Adobe has assigned this vulnerability a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could result in arbitrary code execution in the context of the current user. Depending on the user's privileges, an attacker could potentially install programs, view, change, or delete data, or create new accounts with full user rights (CIS Advisory).

The vulnerability requires user interaction, specifically opening a malicious file, to be exploited. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released version 10.1.1 of Substance 3D Painter to address this vulnerability. Users are advised to update to the latest version immediately after appropriate testing (ASEC).