CVE-2024-20789: Adobe Dimension Use After Free Vulnerability

CVE-2024-20789 Overview

CVE-2024-20789 is a Use After Free vulnerability [CWE-416] affecting Adobe Dimension versions 3.4.11 and earlier. Successful exploitation allows arbitrary code execution in the context of the current user. The flaw requires user interaction, meaning a victim must open a crafted malicious file for exploitation to occur.

Adobe published the issue in security bulletin APSB24-47 on August 14, 2024. The vulnerability carries a CVSS 3.1 base score of 7.8 with a local attack vector.

Critical Impact
An attacker who convinces a user to open a malicious 3D scene or asset file can execute arbitrary code with the privileges of the current user, enabling malware deployment, credential theft, or lateral movement.

Affected Products

Adobe Dimension 3.4.11
Adobe Dimension versions prior to 3.4.11
Windows and macOS installations of Adobe Dimension

Discovery Timeline

2024-08-14 - CVE-2024-20789 published to NVD and Adobe Security Bulletin APSB24-47 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20789

Vulnerability Analysis

Adobe Dimension is a 3D rendering and design application that parses complex scene, model, and material file formats. The vulnerability is a Use After Free condition in the file-parsing logic of Dimension 3.4.11 and earlier. Use After Free occurs when a program continues to reference memory after that memory has been freed, allowing the freed region to be reallocated and manipulated by attacker-controlled data.

An attacker crafts a malicious file that triggers premature deallocation of an object still referenced elsewhere. When Dimension later dereferences that stale pointer, the attacker controls the object contents, redirecting execution flow to attacker-supplied code.

Exploitation runs in the security context of the current user. Users operating with administrative privileges expose the entire host to compromise. See the Adobe Security Bulletin APSB24-47 for vendor details.

Root Cause

The underlying defect is improper object lifetime management [CWE-416]. Dimension retains a pointer to a heap object after the object is freed, and subsequent operations dereference the dangling pointer. The specific parser and object involved are not disclosed in the public advisory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious project or asset file through phishing email, a compromised website, or a shared file store. When the victim opens the file in Adobe Dimension, the parser triggers the Use After Free, leading to arbitrary code execution as the current user.

No verified public proof-of-concept code is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

Detection Methods for CVE-2024-20789

Indicators of Compromise

Unexpected child processes spawned by Dimension.exe such as cmd.exe, powershell.exe, or scripting hosts
Crashes or abnormal termination of Adobe Dimension when opening third-party files
Adobe Dimension writing executable content to user-writable directories such as %TEMP% or %APPDATA%
Outbound network connections initiated by Dimension.exe to untrusted destinations

Detection Strategies

Monitor process creation events where Adobe Dimension is the parent process and correlate with command-line arguments indicative of living-off-the-land binaries
Alert on Adobe Dimension loading unsigned or unexpected DLLs at runtime
Inspect email and web gateways for Dimension-associated file types such as .dn, .obj, .fbx, and .gltf originating from untrusted senders

Monitoring Recommendations

Track installed versions of Adobe Dimension across the fleet and flag any host running 3.4.11 or earlier
Enable EDR telemetry for file-open events targeting 3D asset formats handled by Dimension
Review authentication and file-access logs on hosts where creative software is installed for signs of post-exploitation activity

How to Mitigate CVE-2024-20789

Immediate Actions Required

Update Adobe Dimension to the version identified in Adobe Security Bulletin APSB24-47 on all Windows and macOS endpoints
Instruct users to avoid opening Dimension files received from untrusted or unverified sources
Enforce least privilege by ensuring designers and content creators do not run Dimension with administrative rights

Patch Information

Adobe released a fixed build of Adobe Dimension addressing this vulnerability alongside bulletin APSB24-47 on August 14, 2024. Administrators should deploy the update through Adobe Creative Cloud or their standard software distribution mechanism. Refer to the Adobe Security Bulletin APSB24-47 for the exact fixed version and download instructions.

Workarounds

Block delivery of Dimension asset files from external senders at the email gateway until patching is complete
Restrict execution of Adobe Dimension to users with a documented business need using application control policies
Apply Attack Surface Reduction rules on Windows to block child process creation from Office and creative applications where feasible

bash

# Example: verify installed Adobe Dimension version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Dimension*" } |
  Select-Object DisplayName, DisplayVersion, Publisher