Vulnerability · Published Oct 9, 2024 · Assigned by adobe

CVE-2024-45142Substance3D - Stager | Write-what-where Condition (CWE-123)

High 7.8

In plain English

A high-severity security flaw in Substance3D - Stager from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Substance3D - Stager versions 3.0.3 and earlier are affected by a Write-what-where Condition vulnerability that could allow an attacker to execute arbitrary code in the context of the current user. This vulnerability allows an attacker to write a controlled value to an arbitrary memory location, potentially leading to code execution. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected products (as reported)

Vendor	Product	Versions
Adobe	Substance3D - Stager	0 – through 3.0.3

Weakness: CWE-123 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html vendor-advisory