First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-48380

MediumCVSS 5.5/10Last modified Oct 28, 2026

Description

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Adobe	Adobe Substance 3D Painter	<= 12.1.5

References

https://www.adobe.com/trust/security/products/substance3d-painter/apsb26-178.html

Timeline

Published: Oct 27, 2026
Last modified: Oct 28, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-483819.0Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab CVE-2026-4838210.0Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the contex CVE-2026-4838310.0Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the contex CVE-2026-483844.9ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with CVE-2026-483857.7ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that c CVE-2026-483867.5ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory CVE-2026-483876.2CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service CVE-2026-483888.6Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execu CVE-2026-483897.8DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code exec CVE-2026-48397.3A vulnerability has been found in SourceCodester Food Ordering System 1.0. This affects an unknown function of the file /purchase.php of the CVE-2026-483908.2Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vu CVE-2026-483918.2Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current use

CVE-2026-48380: Medium severity, CVSS 5.5 | Vulnix