CVE-2024-45146 Overview
CVE-2024-45146 is a Use After Free vulnerability [CWE-416] affecting Adobe Dimension versions 4.0.3 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious file. Adobe published the fix in security advisory APSB24-74 on October 8, 2024.
The vulnerability requires local file access and user interaction, limiting remote exploitation. However, successful exploitation grants attackers the same privileges as the logged-in user. Compromised accounts with administrative rights extend the impact to the entire host system.
Critical Impact
Attackers can achieve arbitrary code execution on Windows and macOS systems running vulnerable Adobe Dimension builds when users open a malicious document.
Affected Products
- Adobe Dimension 4.0.3 and earlier
- Microsoft Windows
- Apple macOS
Discovery Timeline
- 2024-10-09 - CVE-2024-45146 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45146
Vulnerability Analysis
CVE-2024-45146 is a Use After Free (UAF) memory corruption bug in Adobe Dimension, a 3D design and rendering application. The issue arises during file parsing when the application references heap memory that has already been freed. Attackers who control the freed memory contents can hijack execution flow.
Adobe Dimension processes complex scene, material, and asset files. Parsing routines allocate and release numerous objects during import. A crafted file forces the application to free an object while retaining a stale pointer. Subsequent dereference of that pointer executes attacker-controlled data.
Exploitation yields code execution at the privilege level of the user running Dimension. Standard users face session compromise. Administrators risk full system takeover, credential theft, and lateral movement.
Root Cause
The root cause is improper object lifetime management inside Adobe Dimension file parsing logic. A pointer continues to reference a memory region after the underlying object is deallocated. When the application reuses that pointer, the freed slot may already hold attacker-supplied data placed through heap grooming.
Attack Vector
Exploitation follows a client-side social engineering pattern. The attacker delivers a weaponized Dimension project or asset file through email, chat, cloud share, or web download. The victim opens the file in Adobe Dimension, triggering the vulnerable parser path.
The malicious file shapes the heap to place controlled data at the freed allocation. When Dimension dereferences the dangling pointer, the attacker gains control of a function pointer or virtual table entry. Shellcode then executes with the user's token.
See the Adobe Security Advisory APSB24-74 for vendor technical details.
Detection Methods for CVE-2024-45146
Indicators of Compromise
- Unexpected child processes spawned by Dimension.exe on Windows or the Dimension app bundle on macOS.
- Adobe Dimension crashes referencing access violations at freed heap addresses inside parser modules.
- Outbound network connections initiated by the Dimension process to unfamiliar hosts shortly after opening a file.
- Newly created executables, scripts, or scheduled tasks in the user profile following a Dimension file open.
Detection Strategies
- Monitor Adobe Dimension process telemetry for anomalous module loads, code injection attempts, and unsigned DLL loads.
- Alert on Dimension opening files from download folders, email attachment paths, or removable media.
- Correlate application crash events with subsequent process creations under the same user session.
Monitoring Recommendations
- Ingest endpoint process creation and file access logs into a SIEM for retrospective hunting.
- Track Adobe Dimension version inventory across managed endpoints to identify unpatched hosts.
- Enable exploit protection telemetry such as Windows Defender Exploit Guard and macOS Endpoint Security framework events.
How to Mitigate CVE-2024-45146
Immediate Actions Required
- Upgrade Adobe Dimension to version 4.0.4 or later on every Windows and macOS endpoint.
- Block delivery of Dimension file types from untrusted external sources at the email gateway and web proxy.
- Instruct users to open Dimension files only from verified internal sources until patching is complete.
- Restrict local administrator rights so that a successful exploit does not automatically yield full system control.
Patch Information
Adobe released the fix in security bulletin APSB24-74. Update Adobe Dimension to version 4.0.4 or later through the Creative Cloud desktop application. Verify the installed build after deployment using the Help menu About dialog.
Workarounds
- Disable or uninstall Adobe Dimension on endpoints where the application is not required.
- Enforce application allowlisting to prevent Dimension from launching unapproved child processes.
- Apply operating system exploit mitigations including Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard on Windows hosts.
# Windows: verify installed Adobe Dimension version via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "Adobe Dimension*" } |
Select-Object DisplayName, DisplayVersion, InstallDate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
