CVE-2024-45142 Overview
CVE-2024-45142 affects Adobe Substance 3D Stager versions 3.0.3 and earlier. The flaw is a write-what-where condition [CWE-123] that lets an attacker write a controlled value to an arbitrary memory location. Successful exploitation results in arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file crafted by the attacker. The issue impacts installations on both Microsoft Windows and Apple macOS. Adobe published the fix in security bulletin APSB24-81.
Critical Impact
An attacker who convinces a user to open a crafted Substance 3D Stager project file can achieve arbitrary code execution with the privileges of the logged-in user.
Affected Products
- Adobe Substance 3D Stager 3.0.3 and earlier
- Microsoft Windows (host platform)
- Apple macOS (host platform)
Discovery Timeline
- 2024-10-09 - CVE-2024-45142 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45142
Vulnerability Analysis
CVE-2024-45142 is classified under [CWE-123: Write-what-where Condition]. This weakness lets an attacker control both the value written and the destination address of that write. The condition gives an attacker two primitives at once: arbitrary data and arbitrary target. Combined, these primitives enable overwriting critical structures such as function pointers, virtual tables, or return addresses. The result is redirected execution flow and arbitrary code execution in the process context.
The vulnerability requires local access and user interaction. An attacker must deliver a malicious file that the victim opens in Substance 3D Stager. The impact spans confidentiality, integrity, and availability because code runs with the user's privileges.
Root Cause
Adobe's advisory identifies the flaw as a write-what-where condition in file parsing logic within Substance 3D Stager. The root cause is insufficient validation of offsets or pointer fields inside a parsed asset or scene file. When the application processes an attacker-controlled structure, it uses supplied values as memory write targets without verifying they fall within safe, allocated bounds. This missing validation collapses the boundary between data and control-flow state.
Attack Vector
The attack vector is local and file-based. An attacker crafts a malicious .ssg or related Substance 3D Stager project file containing manipulated fields that trigger the write-what-where primitive during parsing. The attacker delivers the file through phishing, drive-by download, chat, or shared storage. When the victim opens the file in Substance 3D Stager, parsing executes the attacker's controlled write, hijacks execution, and runs code as the current user. No elevated privileges are required to launch the attack, and no authentication to the target host is needed.
No public proof-of-concept exploit or exploitation in the wild has been reported for this CVE at time of writing.
Detection Methods for CVE-2024-45142
Indicators of Compromise
- Unexpected child processes spawned by Adobe Substance 3D Stager.exe (Windows) or the Stager binary on macOS, particularly command interpreters such as cmd.exe, powershell.exe, bash, or osascript.
- Crash dumps or Windows Error Reporting entries referencing Substance 3D Stager modules after opening a third-party project file.
- Inbound Substance 3D project files (.ssg, .sbs, .sbsar) delivered by email, chat, or unfamiliar external shares.
Detection Strategies
- Hunt for process-lineage anomalies where Substance 3D Stager launches scripting engines, LOLBins, or network utilities.
- Alert on Substance 3D Stager writing executable content (.exe, .dll, .dylib, .scpt) into user-writable directories such as %APPDATA%, %TEMP%, or ~/Library.
- Correlate file-open events on Substance 3D project files with subsequent outbound network connections from the Stager process.
Monitoring Recommendations
- Inventory endpoints running Adobe Substance 3D Stager and track installed versions against the fixed release.
- Enable EDR telemetry for module loads and memory-protection changes inside the Stager process to catch shellcode staging.
- Monitor mail and web gateways for inbound Substance 3D project files from untrusted senders and quarantine for sandbox review.
How to Mitigate CVE-2024-45142
Immediate Actions Required
- Upgrade Adobe Substance 3D Stager to the version listed in Adobe security bulletin APSB24-81 on all Windows and macOS endpoints.
- Restrict opening of Substance 3D project files sourced from external or untrusted origins until patching is confirmed.
- Communicate the risk to design and 3D-content teams so they refuse unsolicited project files.
Patch Information
Adobe released fixed builds addressing CVE-2024-45142 in the Adobe Substance 3D Stager Advisory (APSB24-81). Administrators should deploy the update through the Adobe Creative Cloud desktop client or their standard software distribution tooling. Confirm the installed version is later than 3.0.3 on every affected host.
Workarounds
- Run Substance 3D Stager under a standard (non-administrator) user account to limit the blast radius of successful exploitation.
- Block delivery of Substance 3D project file extensions at email and web gateways where business workflows allow.
- Enforce application allowlisting to prevent Stager from launching secondary interpreters or dropped executables.
# Windows: enumerate installed Substance 3D Stager versions across managed endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
Select-Object DisplayName, DisplayVersion, InstallLocation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
