CWE-787: Out-of-bounds Write vulnerabilities

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Audition versions 25.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds write vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

Out-of-bounds write vulnerability in the DFX module. Impact: Successful exploitation of this vulnerability may affect availability.

Out-of-bounds write vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.

In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably crashing the process and corrupting memory.

CVE-2026-25585 is a high-severity vulnerability in the InternationalColorConsortium's iccDEV library prior to version 2.3.1.3. It involves improper bounds checking during ICC profile processing, specifically in IccCmm.cpp at line 5793, leading to an out-of-bounds read. This flaw can cause memory disclosure or segmentation faults by accessing memory beyond allocated arrays. Exploitation requires a user to open or process a malformed ICC profile, with no privileges needed but user interaction required. The vulnerability impacts confidentiality, integrity, and availability due to potential memory corruption and data leakage. No known exploits are currently reported in the wild, and the issue has been patched in version 2.

CVE-2026-25584 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.3. It occurs in the CIccTagFloatNum<>::GetValues() function when processing specially crafted ICC color profiles, allowing out-of-bounds writes on the stack. This can lead to memory corruption, potentially enabling information disclosure or arbitrary code execution. Exploitation requires local access and user interaction to process a malicious ICC file, but no privileges are needed. The vulnerability has been patched in version 2.3.1.

CVE-2026-25583 is a high-severity heap buffer overflow vulnerability in the iccDEV library, used for handling ICC color profiles. It occurs in the CIccFileIO::Read8() function when processing malformed ICC profile files due to an unchecked fread operation, leading to improper memory bounds restriction. The flaw affects versions prior to 2.3.1.3 and can be triggered by a local attacker with limited privileges and user interaction. Exploitation could result in complete compromise of confidentiality, integrity, and availability of affected systems. No known exploits are currently in the wild, but the vulnerability has been patched in version 2.3.1.

CVE-2026-25582 is a heap-based buffer overflow vulnerability in the iccDEV library used for ICC color profile manipulation. It occurs in the CIccIO::WriteUInt16Float() function when converting malformed XML to ICC profiles via the iccFromXml tool. The flaw affects versions prior to 2.3.1.3 and requires user interaction to trigger. Exploitation can lead to high impact on confidentiality, integrity, and availability, including potential remote code execution. The vulnerability has a CVSS score of 7.8 (high severity) and has been patched in version 2.3.

A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.