CVE-2024-45144: Adobe Substance 3D Stager RCE Vulnerability

CVE-2024-45144 Overview

CVE-2024-45144 is an out-of-bounds write vulnerability in Adobe Substance 3D Stager versions 3.0.3 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. The vulnerability is classified under [CWE-787] and requires local access with user interaction. Adobe published security bulletin APSB24-81 addressing the issue.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the user running Substance 3D Stager, enabling malware installation, credential theft, or lateral movement.

Affected Products

Adobe Substance 3D Stager versions 3.0.3 and earlier
Apple macOS (as a supported platform)
Microsoft Windows (as a supported platform)

Discovery Timeline

2024-10-09 - CVE-2024-45144 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45144

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition triggered during file parsing in Adobe Substance 3D Stager. When the application processes a crafted project or asset file, it writes data past the intended boundary of an allocated memory buffer. This memory corruption can overwrite adjacent structures such as function pointers, object metadata, or return addresses on the stack.

Exploitation requires the victim to open a malicious file, making this a client-side attack typically delivered through phishing, malicious downloads, or shared asset libraries. Because Substance 3D Stager is a 3D staging and rendering tool, attackers can weaponize file formats that designers routinely open without suspicion.

Once triggered, the corrupted memory can be leveraged to hijack the control flow of the process. The result is code execution at the privilege level of the user, which on Windows and macOS workstations frequently includes access to sensitive documents, cloud sync folders, and cached credentials.

Root Cause

The root cause is insufficient bounds checking on attacker-controlled length or offset fields during file parsing. The parser trusts values from the input file when calculating write positions, allowing writes outside the allocated buffer.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Substance 3D Stager file and delivers it via email attachment, compromised website, or supply-chain asset repository. Opening the file in a vulnerable version triggers the out-of-bounds write and hands execution to the attacker.

No verified public proof-of-concept or exploit code is available at this time. See the Adobe Security Patch APSB24-81 for vendor technical details.

Detection Methods for CVE-2024-45144

Indicators of Compromise

Substance 3D Stager (Adobe Substance 3D Stager.exe on Windows, equivalent bundle on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters
Crashes of Substance 3D Stager followed by writes to autorun locations, scheduled tasks, or LaunchAgents
Unusual outbound network connections initiated by the Substance 3D Stager process shortly after opening a project file
Substance 3D Stager files (.sbs, .sbsar, or associated asset files) arriving from untrusted email senders or unknown file-sharing links

Detection Strategies

Monitor process ancestry for Substance 3D Stager launching interpreters, script hosts, or LOLBins that would not appear in normal design workflows
Alert on Substance 3D Stager process crashes correlated with recent file opens from download or temporary directories
Track file writes made by the Substance 3D Stager process to sensitive OS locations outside its normal project directories
Ingest endpoint telemetry into a data lake and hunt for anomalous module loads or memory-protection changes in the Substance 3D Stager process

Monitoring Recommendations

Inventory endpoints running Adobe Substance 3D Stager and confirm installed versions against the patched baseline
Enable Windows Defender Exploit Guard or equivalent macOS hardening features to log memory-integrity violations
Forward EDR process, file, and network telemetry to a centralized SIEM for correlation and retention
Establish baselines for typical Substance 3D Stager behavior so deviations can be identified quickly

How to Mitigate CVE-2024-45144

Immediate Actions Required

Upgrade Adobe Substance 3D Stager to the fixed version listed in the Adobe Security Patch APSB24-81 advisory
Restrict opening of Substance 3D Stager files from untrusted or unverified sources until patching is complete
Deploy application allow-listing to prevent unauthorized child processes from Substance 3D Stager
Communicate the threat to design and creative teams so they recognize social-engineering lures using 3D asset files

Patch Information

Adobe released a security update for Substance 3D Stager addressing CVE-2024-45144. Administrators should apply the update documented in the Adobe Security Patch APSB24-81 bulletin. The patch corrects the bounds checking in the affected file parser and eliminates the out-of-bounds write condition.

Workarounds

Block inbound email attachments and downloads with Substance 3D Stager file extensions at the perimeter until systems are patched
Run Substance 3D Stager under a standard user account with no local administrator privileges to limit post-exploitation impact
Isolate design workstations on segmented networks to reduce blast radius if code execution occurs

bash

# Configuration example: verify installed Substance 3D Stager version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Stager" /s | findstr /I "Version"

# On macOS, verify installed version
defaults read "/Applications/Adobe Substance 3D Stager/Adobe Substance 3D Stager.app/Contents/Info.plist" CFBundleShortVersionString