CVE-2025-21130: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-21130 Overview

CVE-2025-21130 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Substance 3D Stager versions 3.0.4 and earlier. Successful exploitation allows arbitrary code execution in the context of the current user. The flaw requires user interaction: a victim must open a malicious file crafted by the attacker. Adobe published the issue in security bulletin APSB25-03 on January 14, 2025.

The vulnerability affects Substance 3D Stager installations on both Apple macOS and Microsoft Windows. While no public proof-of-concept is currently available and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, the potential for arbitrary code execution makes patching a priority for design and 3D content workflows.

Critical Impact
Opening a malicious Substance 3D Stager file can trigger arbitrary code execution under the user's account, enabling malware installation, data theft, or lateral movement.

Affected Products

Adobe Substance 3D Stager versions 3.0.4 and earlier
Apple macOS installations of Substance 3D Stager
Microsoft Windows installations of Substance 3D Stager

Discovery Timeline

2025-01-14 - CVE-2025-21130 published to NVD
2025-01-14 - Adobe releases security bulletin APSB25-03
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21130

Vulnerability Analysis

The vulnerability is an out-of-bounds write in Adobe Substance 3D Stager's file parsing logic. Out-of-bounds write conditions occur when an application writes data past the boundary of an allocated memory buffer. In Substance 3D Stager, parsing a malformed project or asset file causes the application to write attacker-controlled data outside the intended buffer.

This class of memory corruption can overwrite adjacent heap metadata, function pointers, or virtual table entries. An attacker who controls the overwritten data can redirect program execution to attacker-supplied code. Because Substance 3D Stager runs as a user-mode desktop application, the resulting code execution inherits the privileges of the logged-in user.

Exploitation is local and requires user interaction, but no privileges are needed on the target system. The confidentiality, integrity, and availability impact are all rated high because arbitrary code execution permits complete control over the user session.

Root Cause

The root cause is improper validation of size, offset, or length values during the deserialization of 3D scene data. The parser fails to ensure that the write destination falls within the bounds of the destination buffer, classifying the issue under [CWE-787] Out-of-bounds Write.

Attack Vector

The attack vector is local file delivery combined with social engineering. An attacker distributes a malicious .stager project or supporting asset file via email, shared storage, a 3D asset marketplace, or a download link. When the victim opens the file in Substance 3D Stager, the malformed structure triggers the out-of-bounds write and the attacker's shellcode executes within the application process.

No network exposure of Substance 3D Stager is required. The exploit relies entirely on convincing a user to open the crafted file, making this a useful payload for targeted attacks against creative, design, and product visualization teams.

No public exploit code or proof-of-concept has been released. Refer to the Adobe Security Advisory APSB25-03 for vendor technical detail.

Detection Methods for CVE-2025-21130

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe or the macOS equivalent binary, especially shells, scripting interpreters, or rundll32.exe.
Substance 3D Stager process crashes or anomalous exception events shortly after opening a third-party file.
Outbound network connections originating from the Substance 3D Stager process to non-Adobe infrastructure.
Newly written executables, scripts, or scheduled tasks created by the Substance 3D Stager process tree.

Detection Strategies

Monitor for process injection or memory allocation patterns consistent with shellcode execution inside Substance 3D Stager.
Alert on Substance 3D Stager opening files from unusual locations such as browser download folders, email attachment caches, or removable media.
Correlate file-open telemetry with subsequent process or persistence creation events to surface exploitation chains.

Monitoring Recommendations

Inventory all endpoints running Adobe Substance 3D Stager and flag versions at or below 3.0.4.
Log file-open events for .stager and related asset extensions across creative workstations.
Track Substance 3D Stager version strings reported by endpoint agents to confirm patch deployment progress.

How to Mitigate CVE-2025-21130

Immediate Actions Required

Update Adobe Substance 3D Stager to the fixed version listed in APSB25-03 on all Windows and macOS endpoints.
Instruct users not to open Substance 3D Stager files received from untrusted or unverified sources.
Restrict execution of Substance 3D Stager to user accounts that do not hold local administrator rights.

Patch Information

Adobe addressed CVE-2025-21130 in the update referenced by security bulletin APSB25-03. Administrators should deploy the latest available version through Adobe Creative Cloud or their managed software distribution platform. Versions 3.0.4 and earlier remain vulnerable.

Workarounds

Block delivery of Substance 3D Stager project files from external email senders at the mail gateway until patching is complete.
Apply application allowlisting to prevent Substance 3D Stager from launching unsigned child processes.
Isolate creative workstations on a dedicated network segment with limited outbound access to reduce the impact of successful exploitation.

bash

# Example: query installed Substance 3D Stager version on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation