CVE-2023-26345
📋 TL;DR
Adobe Dimension versions 3.4.7 and earlier contain an out-of-bounds read vulnerability that could allow attackers to read sensitive memory contents. This could potentially bypass security mitigations like ASLR. Users who open malicious files with vulnerable versions are affected.
💻 Affected Systems
- Adobe Dimension
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure leading to ASLR bypass, enabling more sophisticated attacks like remote code execution through memory corruption chaining.
Likely Case
Limited information disclosure from process memory, potentially exposing sensitive data or system information.
If Mitigated
No impact if users don't open untrusted files or if proper file validation is in place.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.8 or later
Vendor Advisory: https://helpx.adobe.com/security/products/dimension/apsb23-20.html
Restart Required: Yes
Instructions:
1. Open Adobe Dimension. 2. Go to Help > Check for Updates. 3. Follow prompts to install version 3.4.8 or later. 4. Restart Adobe Dimension after installation.
🔧 Temporary Workarounds
Restrict file opening
allOnly open trusted .dim files from verified sources
Application control
allUse application whitelisting to restrict execution of Adobe Dimension
🧯 If You Can't Patch
- Implement strict file validation policies for .dim files
- Use endpoint protection with file reputation checking
🔍 How to Verify
Check if Vulnerable:
Check Adobe Dimension version in Help > About Adobe Dimension. If version is 3.4.7 or earlier, system is vulnerable.Check Version:
On Windows: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Dimension\Version. On macOS: Check /Applications/Adobe Dimension.app/Contents/Info.plistVerify Fix Applied:
Verify version is 3.4.8 or later in Help > About Adobe Dimension.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected file opens of .dim files
Network Indicators:
- Downloads of .dim files from untrusted sources
SIEM Query:
EventID=1 OR EventID=4688 AND (CommandLine LIKE '%dimension%' OR ParentCommandLine LIKE '%dimension%') AND (CommandLine LIKE '%.dim%' OR ParentCommandLine LIKE '%.dim%')