CVE-2023-25875
📋 TL;DR
Adobe Substance 3D Stager versions 2.0.0 and earlier contain an out-of-bounds read vulnerability that could allow an attacker to read sensitive memory information, potentially bypassing security mitigations like ASLR. Users who open malicious files with affected versions are at risk.
💻 Affected Systems
- Adobe Substance 3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could obtain sensitive memory layout information to bypass ASLR and chain with other vulnerabilities for arbitrary code execution.
Likely Case
Information disclosure of memory contents, potentially revealing sensitive data or system information.
If Mitigated
Limited information disclosure with no direct code execution if proper file handling controls are in place.
🎯 Exploit Status
Requires user to open a malicious file. Exploitation depends on memory layout and other factors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.1 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
Restart Required: Yes
Instructions:
1. Open Adobe Substance 3D Stager. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Restart the application.
🔧 Temporary Workarounds
Restrict file handling
allOnly open files from trusted sources and avoid unknown or suspicious files.
🧯 If You Can't Patch
- Restrict user permissions to limit potential impact
- Implement application whitelisting to prevent execution of unauthorized files
🔍 How to Verify
Check if Vulnerable:
Check Adobe Substance 3D Stager version in Help > About. If version is 2.0.0 or earlier, it is vulnerable.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 2.0.1 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Application crash logs related to memory access violations
- Unexpected file processing errors
Network Indicators:
- File downloads from untrusted sources followed by application crashes
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="Adobe Substance 3D Stager.exe" AND Description CONTAINS "access violation"