Vulnerability-Lookup

CVE-2024-47438 (GCVE-0-2024-47438)

Vulnerability from cvelistv5 – Published: 2024-11-12 20:02 – Updated: 2024-11-12 20:25

Title

Substance3D - Painter | Write-what-where Condition (CWE-123)

Summary

Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memory content. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-12 20:16 UTC

CWE

CWE-123 - Write-what-where Condition (CWE-123)

Assigner

adobe mitre root

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/substan…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version	CPE status
Adobe	Substance3D - Painter	Affected: 0 , ≤ 10.1.0 (semver)	guessed
adobe	substance_3d_painter	Affected: 0 , ≤ 10.1.0 (custom) cpe:2.3:a:adobe:substance_3d_painter::::::::

Date Public

2024-11-12 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:adobe:substance_3d_painter:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "substance_3d_painter",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "10.1.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47438",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T20:16:04.087743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T20:25:31.310Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Substance3D - Painter",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "10.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-11-12T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memory content. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-123",
              "description": "Write-what-where Condition (CWE-123)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-12T20:02:14.066Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Substance3D - Painter | Write-what-where Condition (CWE-123)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2024-47438",
    "datePublished": "2024-11-12T20:02:14.066Z",
    "dateReserved": "2024-09-24T17:40:22.372Z",
    "dateUpdated": "2024-11-12T20:25:31.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47438",
      "date": "2026-09-14",
      "epss": "0.00226",
      "percentile": "0.13339"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:substance_3d_painter:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.1.1\", \"matchCriteriaId\": \"2685544B-784F-49A0-9BE0-B209DC10D16E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memory content. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\"}, {\"lang\": \"es\", \"value\": \"Las versiones 10.1.0 y anteriores de Substance3D - Painter se ven afectadas por una vulnerabilidad de condici\\u00f3n de escritura que podr\\u00eda provocar una p\\u00e9rdida de memoria. Esta vulnerabilidad permite a un atacante escribir un valor controlado en una ubicaci\\u00f3n de memoria controlada, lo que podr\\u00eda provocar la divulgaci\\u00f3n de contenido confidencial de la memoria. Para explotar este problema es necesaria la interacci\\u00f3n del usuario, ya que la v\\u00edctima debe abrir un archivo malicioso.\"}]",
      "id": "CVE-2024-47438",
      "lastModified": "2024-11-13T19:13:57.320",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@adobe.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-11-12T20:15:10.720",
      "references": "[{\"url\": \"https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@adobe.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"psirt@adobe.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-123\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47438\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2024-11-12T20:15:10.720\",\"lastModified\":\"2026-06-17T07:57:06.190\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memory content. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\"},{\"lang\":\"es\",\"value\":\"Las versiones 10.1.0 y anteriores de Substance3D - Painter se ven afectadas por una vulnerabilidad de condici\u00f3n de escritura que podr\u00eda provocar una p\u00e9rdida de memoria. Esta vulnerabilidad permite a un atacante escribir un valor controlado en una ubicaci\u00f3n de memoria controlada, lo que podr\u00eda provocar la divulgaci\u00f3n de contenido confidencial de la memoria. Para explotar este problema es necesaria la interacci\u00f3n del usuario, ya que la v\u00edctima debe abrir un archivo malicioso.\"}],\"affected\":[{\"source\":\"psirt@adobe.com\",\"affectedData\":[{\"vendor\":\"Adobe\",\"product\":\"Substance3D - Painter\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"10.1.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"adobe\",\"product\":\"substance_3d_painter\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:adobe:substance_3d_painter:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"10.1.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-11-12T20:16:04.087743Z\",\"id\":\"CVE-2024-47438\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-123\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:substance_3d_painter:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.1.1\",\"matchCriteriaId\":\"2685544B-784F-49A0-9BE0-B209DC10D16E\"}]}]}],\"references\":[{\"url\":\"https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T19:28:22+00:00",
      "cve": "CVE-2024-47438",
      "id": "CVE-2024-47438",
      "initial_release_date": "2024-11-12T17:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Substance3D - Painter | Write-what-where Condition (CWE-123)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47438.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47438\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-12T20:16:04.087743Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:adobe:substance_3d_painter:*:*:*:*:*:*:*:*\"], \"vendor\": \"adobe\", \"product\": \"substance_3d_painter\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"10.1.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-12T20:16:44.234Z\"}}], \"cna\": {\"title\": \"Substance3D - Painter | Write-what-where Condition (CWE-123)\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"modifiedScope\": \"UNCHANGED\", \"temporalScore\": 5.5, \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"remediationLevel\": \"NOT_DEFINED\", \"reportConfidence\": \"NOT_DEFINED\", \"temporalSeverity\": \"MEDIUM\", \"availabilityImpact\": \"NONE\", \"environmentalScore\": 5.5, \"privilegesRequired\": \"NONE\", \"exploitCodeMaturity\": \"NOT_DEFINED\", \"integrityRequirement\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"LOCAL\", \"confidentialityImpact\": \"HIGH\", \"environmentalSeverity\": \"MEDIUM\", \"availabilityRequirement\": \"NOT_DEFINED\", \"modifiedIntegrityImpact\": \"NONE\", \"modifiedUserInteraction\": \"REQUIRED\", \"modifiedAttackComplexity\": \"LOW\", \"confidentialityRequirement\": \"NOT_DEFINED\", \"modifiedAvailabilityImpact\": \"NONE\", \"modifiedPrivilegesRequired\": \"NONE\", \"modifiedConfidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Adobe\", \"product\": \"Substance3D - Painter\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.1.0\"}], \"defaultStatus\": \"affected\"}], \"datePublic\": \"2024-11-12T17:00:00.000Z\", \"references\": [{\"url\": \"https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memory content. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-123\", \"description\": \"Write-what-where Condition (CWE-123)\"}]}], \"providerMetadata\": {\"orgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"shortName\": \"adobe\", \"dateUpdated\": \"2024-11-12T20:02:14.066Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47438\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-12T20:25:31.310Z\", \"dateReserved\": \"2024-09-24T17:40:22.372Z\", \"assignerOrgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"datePublished\": \"2024-11-12T20:02:14.066Z\", \"assignerShortName\": \"adobe\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2025-24446

Vulnerability from cnvd - Published: 2025-10-22

Title

Adobe Substance 3D Painter越界写入漏洞（CNVD-2025-24446）

Description

Adobe Substance 3D Painter是美国奥多比（Adobe）公司的一个3D纹理处理应用程序。 Adobe Substance 3D Painter存在越界写入漏洞，攻击者可利用该漏洞导致敏感内存泄露。

Severity

中

Patch Name

Adobe Substance 3D Painter越界写入漏洞（CNVD-2025-24446）的补丁

Patch Description

Adobe Substance 3D Painter是美国奥多比（Adobe）公司的一个3D纹理处理应用程序。 Adobe Substance 3D Painter存在越界写入漏洞，攻击者可利用该漏洞导致敏感内存泄露。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html

Reference

https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html

Impacted products

Name
Adobe Substance 3D Painter <=10.1.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-47438",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-47438"
    }
  },
  "description": "Adobe Substance 3D Painter\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u4e2a3D\u7eb9\u7406\u5904\u7406\u5e94\u7528\u7a0b\u5e8f\u3002\n\nAdobe Substance 3D Painter\u5b58\u5728\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u654f\u611f\u5185\u5b58\u6cc4\u9732\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-24446",
  "openTime": "2025-10-22",
  "patchDescription": "Adobe Substance 3D Painter\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u4e2a3D\u7eb9\u7406\u5904\u7406\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nAdobe Substance 3D Painter\u5b58\u5728\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u654f\u611f\u5185\u5b58\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Adobe Substance 3D Painter\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff08CNVD-2025-24446\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Adobe Substance 3D Painter \u003c=10.1.0"
  },
  "referenceLink": "https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html",
  "serverity": "\u4e2d",
  "submitTime": "2024-11-15",
  "title": "Adobe Substance 3D Painter\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff08CNVD-2025-24446\uff09"
}

FKIE_CVE-2024-47438

Vulnerability from fkie_nvd - Published: 2024-11-12 20:15 - Updated: 2026-06-17 07:57

Severity

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	psirt@adobe.com	https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html	Vendor Advisory

Impacted products

	Vendor	Product	Version
	adobe	substance_3d_painter	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "product": "Substance3D - Painter",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "10.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@adobe.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:adobe:substance_3d_painter:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "substance_3d_painter",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "10.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:substance_3d_painter:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2685544B-784F-49A0-9BE0-B209DC10D16E",
              "versionEndExcluding": "10.1.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memory content. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
    },
    {
      "lang": "es",
      "value": "Las versiones 10.1.0 y anteriores de Substance3D - Painter se ven afectadas por una vulnerabilidad de condici\u00f3n de escritura que podr\u00eda provocar una p\u00e9rdida de memoria. Esta vulnerabilidad permite a un atacante escribir un valor controlado en una ubicaci\u00f3n de memoria controlada, lo que podr\u00eda provocar la divulgaci\u00f3n de contenido confidencial de la memoria. Para explotar este problema es necesaria la interacci\u00f3n del usuario, ya que la v\u00edctima debe abrir un archivo malicioso."
    }
  ],
  "id": "CVE-2024-47438",
  "lastModified": "2026-06-17T07:57:06.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47438",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-11-12T20:16:04.087743Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-11-12T20:15:10.720",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-123"
        }
      ],
      "source": "psirt@adobe.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-4JQW-MWQP-MHQ2

Vulnerability from github – Published: 2024-11-12 21:30 – Updated: 2024-11-12 21:30

Details

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-47438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-123",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-12T20:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memory content. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
  "id": "GHSA-4jqw-mwqp-mhq2",
  "modified": "2024-11-12T21:30:54Z",
  "published": "2024-11-12T21:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47438"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2024-3421

Vulnerability from csaf_certbund - Published: 2024-11-12 23:00 - Updated: 2024-11-12 23:00

Summary

Adobe Creative Cloud Applikationen: Mehrere Schwachstellen

Severity

Mittel

Scope

46 vulnerabilities in this advisory, including CVE-2024-47438.

CVE-2024-47438

Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Painter. Diese Fehler sind auf mehrere Sicherheitslücken zurückzuführen, darunter Heap-basierte Pufferüberläufe, Out-of-Bounds-Reads und -Writes oder ein Double-Free-Problem. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen und vertrauliche Informationen offenzulegen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2024-47438 (GCVE-0-2024-47438)

CNVD-2025-24446

FKIE_CVE-2024-47438

GHSA-4JQW-MWQP-MHQ2

WID-SEC-W-2024-3421

Tags

Sightings

Nomenclature