CVE-2023-26390
📋 TL;DR
Adobe Substance 3D Stager versions 2.0.1 and earlier contain a stack-based buffer overflow vulnerability that allows arbitrary code execution when a user opens a malicious file. This affects users of Adobe Substance 3D Stager who open untrusted project files.
💻 Affected Systems
- Adobe Substance 3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware installation on the affected workstation when a user opens a malicious project file.
If Mitigated
No impact if users only open trusted files from verified sources.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of buffer overflow techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html
Restart Required: Yes
Instructions:
1. Open Adobe Substance 3D Stager
2. Go to Help > Check for Updates
3. Install available updates
4. Restart the application
🔧 Temporary Workarounds
Restrict file opening
allOnly open Substance 3D Stager project files from trusted sources
Application control
allUse application whitelisting to prevent execution of malicious payloads
🧯 If You Can't Patch
- Implement strict file handling policies to only open verified project files
- Run Adobe Substance 3D Stager in a sandboxed environment or virtual machine
🔍 How to Verify
Check if Vulnerable:
Check Adobe Substance 3D Stager version in Help > AboutCheck Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 2.0.2 or later in Help > About📡 Detection & Monitoring
Log Indicators:
- Application crashes with unusual memory addresses
- Unexpected child processes spawned from Substance 3D Stager
Network Indicators:
- Unusual outbound connections after opening project files
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="Adobe Substance 3D Stager.exe"