High · published January 14, 2026
⚡ Just one rogue file and BOOM! An out-of-bounds write in Substance3D could let an attacker execute any code they want—right in your modeling software! 🎨 Think of it like a waiter bringing you a dish with a hidden ingredient you didn’t order—once you take a bite, you might not know what hit you! In this case, the malicious file is that unexpected dish, and it can execute harmful code as soon as you open it. If an attacker tricks you into opening a compromised model file, they could run arbitrary code on your machine. This means they might seize control of your system, steal sensitive information, or wreak havoc on your local environment—yikes!
Think of it like a waiter bringing you a dish with a hidden ingredient you didn’t order—once you take a bite, you might not know what hit you! In this case, the malicious file is that unexpected dish, and it can execute harmful code as soon as you open it. This out-of-bounds write vulnerability in Substance3D Modeler versions 1.22.4 and earlier allows attackers to manipulate memory locations, which can lead to arbitrary code execution if a malicious file is opened by the user.
If an attacker tricks you into opening a compromised model file, they could run arbitrary code on your machine. This means they might seize control of your system, steal sensitive information, or wreak havoc on your local environment—yikes! Immediately update Substance3D Modeler to version 1.22.5 or later to patch this vulnerability. Also, educate users on the dangers of opening unknown files—knowledge is your first line of defense! You’ve got this! Stay vigilant and keep your software updated to ensure your creative space stays safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| adobe/substance_3d_modeler | < 1.22.5 | 1.22.5 |