High severity · published Jun 15, 2023
CVE-2023-21618
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S3
Substance 3d Designer · Adobe
through 12.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-21618
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-21618
Broken Link
https://helpx.adobe.com/security/products/substance3d_designer/apsb23-39.html
More from Substance 3d Designer
7.8
CVE-2026-103821
Substance3D - Designer | Out-of-bounds Write (CWE-787)
7.8
CVE-2026-48432
Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)
7.8
CVE-2026-48430
Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)
7.8
CVE-2026-71564
Substance3D - Designer | Out-of-bounds Write (CWE-787)
7.8
CVE-2026-48426
Substance3D - Designer | Out-of-bounds Write (CWE-787)
