CVE-2024-45140: Adobe Substance 3D Stager RCE Vulnerability

CVE-2024-45140 Overview

CVE-2024-45140 is an out-of-bounds write vulnerability [CWE-787] in Adobe Substance 3D Stager versions 3.0.3 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Exploitation requires user interaction, limiting the vulnerability to social engineering or phishing scenarios. Adobe published fixes in security advisory APSB24-81.

Critical Impact
Successful exploitation results in arbitrary code execution under the current user's privileges, enabling attackers to install malware, exfiltrate data, or pivot within the compromised host.

Affected Products

Adobe Substance 3D Stager versions 3.0.3 and earlier
Apple macOS installations running the affected Stager builds
Microsoft Windows installations running the affected Stager builds

Discovery Timeline

2024-10-09 - CVE-2024-45140 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45140

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] triggered during file parsing in Adobe Substance 3D Stager. When the application processes a crafted project or asset file, it writes data past the bounds of an allocated memory buffer. This memory corruption can overwrite adjacent structures, function pointers, or return addresses on the stack or heap.

Attackers who control the out-of-bounds write can redirect program execution to attacker-supplied shellcode or a return-oriented programming chain. The result is arbitrary code execution inside the Stager process. Because Stager runs with the interactive user's privileges, the attacker inherits access to that user's files, tokens, and network resources.

The attack vector is local, requiring the victim to open a malicious file delivered through email, chat, or a compromised asset library. No prior authentication to the target system is required from the attacker's side. See the Adobe Security Advisory APSB24-81 for vendor confirmation of the affected code paths.

Root Cause

The root cause is insufficient bounds validation when Stager deserializes fields from a project or model file. A malformed size, offset, or index value causes the parser to write beyond the destination buffer.

Attack Vector

An attacker crafts a malicious .stg or supported asset file and delivers it to a target. The victim opens the file in Substance 3D Stager, and the parser triggers the memory corruption. The exploit then executes attacker-controlled code within the Stager process.

Verified proof-of-concept code is not publicly available for CVE-2024-45140.
Refer to Adobe Security Advisory APSB24-81 for vendor-confirmed technical details.

Detection Methods for CVE-2024-45140

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe such as cmd.exe, powershell.exe, or rundll32.exe
Substance 3D Stager crash dumps referencing access violations during file parsing
Inbound delivery of .stg, .sbsar, .usd, or other 3D asset files from untrusted senders
Outbound network connections initiated by the Stager process to non-Adobe infrastructure

Detection Strategies

Monitor process ancestry for Stager launching interpreters, script hosts, or LOLBins
Alert on Stager process crashes with exception codes indicating heap or stack corruption
Inspect email and file-share gateways for 3D asset file types delivered from external sources

Monitoring Recommendations

Collect endpoint telemetry for file open events on Substance 3D file extensions
Aggregate crash and Windows Error Reporting (WER) events centrally for anomaly review
Track user opens of asset files sourced from browsers, email clients, or messaging apps

How to Mitigate CVE-2024-45140

Immediate Actions Required

Update Adobe Substance 3D Stager to a version later than 3.0.3 as directed by Adobe advisory APSB24-81
Restrict opening of Substance 3D project files to those from trusted internal sources
Educate creative and design teams on the risk of opening unsolicited 3D asset files

Patch Information

Adobe released fixed builds of Substance 3D Stager in security bulletin APSB24-81. Administrators should deploy the vendor-supplied update to all workstations running Substance 3D Stager on Windows and macOS.

Workarounds

Block inbound delivery of unsolicited 3D asset file types at email and web gateways until patching completes
Run Substance 3D Stager under standard user accounts rather than administrator accounts to limit blast radius
Isolate design workstations from sensitive network segments until the update is applied

bash

# Verify installed Substance 3D Stager version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion