Adobe Security Bulletin

Last updated on

Security updates available for Substance 3D Designer | APSB23-76

Bulletin ID	Date Published	Priority
APSB23-76	December 12, 2023	3

Summary

Adobe has released an update for Adobe Substance 3D Designer.  This update addresses critical and important vulnerabilities in Substance 3D Designer. Successful exploitation could lead to memory leak and arbitrary code execution in the context of the current user.    

Affected Versions

Product	Version	Platform
Adobe Substance 3D Designer	13.0.0 and earlier versions	All

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app's update mechanism.  For more information, please reference this help page.  

Product	Version	Platform	Priority	Availability
Adobe Substance 3D Designer	13.1.0	All	3	Download Center

For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.

Vulnerability Details

Vulnerability Category	Vulnerability Impact	Severity	CVSS base score	CVSS vector	CVE Numbers
Out-of-bounds Write (CWE-787)	Arbitrary code execution	Critical	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CVE-2023-48639
Out-of-bounds Read (CWE-125)	Memory leak	Important	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	CVE-2023-48636
Out-of-bounds Read (CWE-125)	Memory leak	Important	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	CVE-2023-48637
Out-of-bounds Read (CWE-125)	Memory leak	Important	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	CVE-2023-48638

Acknowledgments:

Adobe would like to thank the following researchers  for reporting the relevant issues and for working with Adobe to help protect our customers:

anonymous - CVE-2023-48636, CVE-2023-48637, CVE-2023-48638, CVE-2023-48639

NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps.

For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com

Adobe

Get help faster and easier

New user?