CVE-2024-41865: Adobe Dimension Untrusted Search Path RCE

CVE-2024-41865 Overview

Adobe Dimension versions 3.4.11 and earlier contain an Untrusted Search Path vulnerability [CWE-426] that can lead to arbitrary code execution. An attacker who plants a malicious file in a directory referenced by the application's search path can cause Dimension to load that file instead of the legitimate executable or library. Successful exploitation requires user interaction, such as the victim launching the application from a compromised working directory. The vulnerability affects local attack scenarios and executes code in the context of the user running Dimension.

Critical Impact

An attacker with local file placement capability can achieve arbitrary code execution in the user's security context by exploiting Dimension's untrusted search path behavior.

Affected Products

• Adobe Dimension 3.4.11
• Adobe Dimension versions prior to 3.4.11
• Windows installations of Adobe Dimension

Discovery Timeline

• 2024-08-14 - CVE-2024-41865 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41865

Vulnerability Analysis

The vulnerability falls under [CWE-426] Untrusted Search Path. Adobe Dimension resolves executables or dynamic libraries using a search path that includes directories an attacker can write to. When the application launches, it loads the first matching file it finds along that path rather than validating the source. An attacker who places a malicious DLL or executable with the expected name in a directory searched before the legitimate location causes Dimension to load and execute the attacker-controlled code.

Exploitation requires user interaction, typically the victim opening a Dimension project file or launching the application from a directory containing the malicious payload. The resulting code execution inherits the privileges of the invoking user, providing full read, write, and execute access to that user's data and processes.

Root Cause

The root cause is insecure library and executable resolution during application startup or runtime module loading. Dimension does not enforce absolute paths or verify the origin of loaded modules, allowing directories under user or attacker control to precede trusted system paths.

Attack Vector

The attack vector is local. An attacker must place a malicious file in a location Dimension will search, such as the current working directory or a writable directory in the resolution order. The victim then launches Dimension or opens a document that triggers the vulnerable code path, causing the malicious file to execute.

No verified proof-of-concept code is publicly available. Refer to the Adobe Security Bulletin APSB24-47 for vendor guidance.

Detection Methods for CVE-2024-41865

Indicators of Compromise

• Unexpected DLL or executable files in directories adjacent to Dimension.exe or in user-writable directories on the resolution path
• Adobe Dimension process spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe
• Module load events showing Dimension loading libraries from user profile or temporary directories rather than the install directory
• Outbound network connections initiated by the Dimension process to untrusted hosts

Detection Strategies

• Monitor process creation events where Adobe Dimension is the parent process and the child process is an interpreter, shell, or scripting host
• Audit image and module load events for Dimension.exe and flag libraries loaded from paths outside the Adobe installation directory
• Baseline the expected DLL set for Dimension and alert on deviations, especially DLLs with recent creation timestamps in user-writable locations

Monitoring Recommendations

• Enable Sysmon Event ID 7 (Image Loaded) with filtering focused on Adobe application binaries
• Correlate file creation events in Dimension working directories with subsequent application launches
• Track version telemetry across endpoints to identify systems still running Dimension 3.4.11 or earlier

How to Mitigate CVE-2024-41865

Immediate Actions Required

• Upgrade Adobe Dimension to the version specified in Adobe Security Bulletin APSB24-47
• Inventory endpoints running Dimension and prioritize hosts used by designers and creative teams
• Restrict write permissions on directories that appear in the Dimension search path

Patch Information

Adobe released fixed builds addressed in security bulletin APSB24-47. Administrators should deploy the updated version through the Adobe Creative Cloud desktop application or via enterprise deployment tooling. Full patch details are available in the Adobe Security Bulletin APSB24-47.

Workarounds

• Launch Adobe Dimension only from trusted, protected installation directories rather than from network shares or user-writable folders
• Apply application allowlisting to block execution of unsigned binaries loaded by Dimension
• Remove write permissions for standard users on any directory that Dimension searches for executables or libraries
• Educate users to avoid opening Dimension project files delivered from untrusted sources

# Configuration example: audit writable directories on the Dimension search path (Windows PowerShell)
Get-ChildItem -Path 'C:\Program Files\Adobe\Adobe Dimension' -Recurse -Include *.dll |
  ForEach-Object { Get-Acl $_.FullName } |
  Where-Object { $_.Access | Where-Object { $_.IdentityReference -match 'Users' -and $_.FileSystemRights -match 'Write' } }