CVE-2024-20743: Adobe Substance 3D Painter RCE Vulnerability

CVE-2024-20743 Overview

CVE-2024-20743 is an out-of-bounds write vulnerability [CWE-787] in Adobe Substance 3D Painter versions 9.1.1 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a crafted file. Exploitation requires user interaction, and the attack vector is local. Adobe published fixes in security advisory APSB24-04.

Critical Impact
A successful exploit grants arbitrary code execution with the privileges of the user running Substance 3D Painter, enabling data theft, persistence, or lateral movement from a workstation.

Affected Products

Adobe Substance 3D Painter 9.1.1
Adobe Substance 3D Painter versions earlier than 9.1.1
Windows and macOS installations of the affected releases

Discovery Timeline

2024-02-15 - CVE-2024-20743 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20743

Vulnerability Analysis

CVE-2024-20743 is an out-of-bounds write [CWE-787] in Adobe Substance 3D Painter. The affected code paths write data past the bounds of an allocated buffer while parsing untrusted file content. Writing outside the intended buffer corrupts adjacent memory structures such as heap metadata, object vtables, or function pointers. An attacker who controls the overwritten values can steer execution into attacker-supplied code.

Because Substance 3D Painter runs as a desktop application, successful exploitation yields code execution as the interactive user. That user often holds access to design assets, licensing tokens, cloud storage credentials, and internal source repositories on creative workstations.

Root Cause

The root cause is missing or incorrect bounds validation when the application deserializes data from a project or asset file. Adobe has not published the specific parser or field involved. Adobe's advisory APSB24-04 confirms the class as out-of-bounds write leading to arbitrary code execution.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Substance 3D Painter file and delivers it through email, chat, shared storage, or a compromised asset marketplace. The victim opens the file in a vulnerable version, triggering the out-of-bounds write and attacker-controlled execution.

No network exposure is required, and no elevated privileges are needed on the target. The exploit runs with the permissions of the current user. See the Adobe Security Advisory APSB24-04 for the vendor description.

Detection Methods for CVE-2024-20743

Indicators of Compromise

Substance 3D Painter (Substance 3D Painter.exe or Adobe Substance 3D Painter) spawning child processes such as cmd.exe, powershell.exe, bash, or osascript.
Unexpected crashes of Substance 3D Painter shortly after opening a third-party project or asset file.
Substance 3D Painter processes writing executables, scripts, or scheduled task entries to user-writable directories.
Outbound network connections from the Substance 3D Painter process to previously unseen hosts following file open events.

Detection Strategies

Alert on process-lineage anomalies where a creative application launches interpreters, shells, or LOLBins.
Correlate file-open telemetry for Substance 3D Painter project files sourced from email attachments or browser downloads with subsequent process creations.
Hunt for crash artifacts and Windows Error Reporting or macOS ReportCrash entries referencing the Substance 3D Painter binary.

Monitoring Recommendations

Inventory endpoints running Substance 3D Painter and track installed versions against 9.1.2 or later.
Monitor for .spp, .spsm, and related project files delivered from outside the organization and opened by users.
Baseline normal network destinations for creative workstations to surface post-exploitation command-and-control traffic.

How to Mitigate CVE-2024-20743

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to the version listed in Adobe Security Advisory APSB24-04 on all Windows and macOS workstations.
Instruct users not to open Substance 3D Painter project files received from untrusted sources until patching completes.
Restrict local administrative rights on creative workstations to limit post-exploitation impact.

Patch Information

Adobe released fixed builds of Substance 3D Painter that address CVE-2024-20743. The vendor guidance and download references are published in Adobe Security Advisory APSB24-04. Organizations should validate the running version through their software inventory or endpoint management platform after deployment.

Workarounds

Block delivery of Substance 3D Painter project files from external email and messaging gateways until patched builds are deployed.
Isolate legacy installations that cannot be updated on dedicated hosts without access to sensitive data or credentials.
Enforce application allowlisting to prevent Substance 3D Painter from spawning shells or scripting interpreters.

bash

# Query installed Substance 3D Painter version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Painter/Adobe Substance 3D Painter.app"

# Query installed version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Painter*" } |
  Select-Object DisplayName, DisplayVersion