CVE-2023-26335 – CVE-2023-26335 is an out-of-bounds read vulnera... (How to Fix)

Q: What is the severity of CVE-2023-26335?

CVE-2023-26335 has a CVSS score of 7.8 (HIGH). CVE-2023-26335 is an out-of-bounds read vulnerability in Adobe Dimension that could allow arbitrary code execution when a user opens a malicious file. Attackers could exploit this to run code with the victim's privileges. Users of Adobe Dimension versions 3.4.7 and earlier are affected.

📋 TL;DR

CVE-2023-26335 is an out-of-bounds read vulnerability in Adobe Dimension that could allow arbitrary code execution when a user opens a malicious file. Attackers could exploit this to run code with the victim's privileges. Users of Adobe Dimension versions 3.4.7 and earlier are affected.

💻 Affected Systems

Products:

Adobe Dimension

Versions: 3.4.7 and earlier

Operating Systems: Windows, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: All installations of affected versions are vulnerable by default when processing files.

📦 What is this software?

Dimension by Adobe

View all CVEs affecting Dimension →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise through remote code execution, leading to data theft, ransomware deployment, or persistent backdoor installation.

🟠

Likely Case

Limited compromise of individual user systems through targeted phishing attacks with malicious Dimension files.

🟢

If Mitigated

No impact if users avoid opening untrusted files and have updated software.

🌐 Internet-Facing: LOW - Exploitation requires user interaction with malicious files, not network exposure.

🏢 Internal Only: MEDIUM - Internal users could be targeted via email attachments or shared drives containing malicious files.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires user interaction (opening malicious file) and bypassing memory protections like ASLR/DEP.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.4.8 or later

Vendor Advisory: https://helpx.adobe.com/security/products/dimension/apsb23-20.html

Restart Required: Yes

Instructions:

1. Open Adobe Dimension. 2. Go to Help > Check for Updates. 3. Follow prompts to install version 3.4.8 or later. 4. Restart the application.

🔧 Temporary Workarounds

Restrict file handling

all

Configure system to open .dim files only with trusted applications or block untrusted .dim files.

🧯 If You Can't Patch

Implement application whitelisting to prevent execution of unauthorized software.
Educate users to never open Dimension files from untrusted sources.

🔍 How to Verify

Check if Vulnerable:

Check Adobe Dimension version in Help > About. If version is 3.4.7 or earlier, system is vulnerable.

Check Version:

On Windows: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Dimension\3.0\Version. On macOS: Check /Applications/Adobe Dimension.app/Contents/Info.plist for CFBundleShortVersionString.

Verify Fix Applied:

Verify version is 3.4.8 or later in Help > About.

📡 Detection & Monitoring

Log Indicators:

Application crashes in Adobe Dimension with memory access violations
Unexpected child processes spawned from Adobe Dimension

Network Indicators:

Outbound connections from Adobe Dimension to unexpected destinations

SIEM Query:

source="*adobe dimension*" AND (event_type="crash" OR process_name="*dimension*")

📊 Metadata

CVE ID: CVE-2023-26335

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-125

Published: March 28, 2023

Last Updated: November 21, 2024

🔗 References

https://helpx.adobe.com/security/products/dimension/apsb23-20.html Patch,Vendor Advisory
https://helpx.adobe.com/security/products/dimension/apsb23-20.html Patch,Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-26335, you might also want to check these: