CVE-2025-21136: Adobe Substance 3D Designer RCE Flaw

CVE-2025-21136 Overview

CVE-2025-21136 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Substance 3D Designer versions 14.0 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a crafted file. Exploitation requires user interaction, limiting mass exploitation, but a successful attack grants the attacker the privileges of the targeted user. Adobe addressed the issue in security bulletin APSB25-06.

Critical Impact
Attackers who convince a user to open a malicious Substance 3D Designer project file can execute arbitrary code on the host, leading to full compromise of the user account and accessible data.

Affected Products

Adobe Substance 3D Designer 14.0
Adobe Substance 3D Designer prior to 14.0
Windows and macOS installations of the affected versions

Discovery Timeline

2025-01-14 - CVE-2025-21136 published to the National Vulnerability Database (NVD)
2025-01-21 - Last updated in NVD database

Technical Details for CVE-2025-21136

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in Adobe Substance 3D Designer. The application writes data past the end of an allocated memory buffer when parsing a malformed input file. Attackers can use this write primitive to corrupt adjacent memory structures, including function pointers or object metadata, and redirect execution to attacker-controlled code.

Exploitation requires local file handling and user interaction. The attacker delivers a crafted Substance Designer project, material, or asset file through email, web download, or shared storage. When the victim opens the file in Substance 3D Designer, the parser triggers the memory corruption and executes the embedded payload with the victim's privileges.

The attack does not require elevated privileges before exploitation. Code runs in the context of the current user, providing access to the user's files, credentials, and network resources reachable from the workstation.

Root Cause

The root cause is insufficient bounds validation during file parsing inside Substance 3D Designer. The application calculates a write offset or length from untrusted file fields without verifying that the destination remains within the allocated buffer. Adobe has not published detailed internals of the affected component. Refer to the Adobe Security Bulletin APSB25-06 for vendor-confirmed details.

Attack Vector

The attack vector is local and requires user interaction. A typical chain proceeds as follows:

The attacker creates a malicious Substance 3D Designer file with crafted fields that trigger the out-of-bounds write.
The attacker delivers the file through phishing, a watering hole, or a shared asset library.
The victim opens the file in a vulnerable version of Substance 3D Designer.
The parser writes attacker-controlled data outside the intended buffer.
Memory corruption redirects execution to attacker code running as the current user.

No public proof-of-concept or in-the-wild exploitation has been reported at the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-21136

Indicators of Compromise

Unexpected child processes spawned by Substance 3D Designer.exe or the macOS equivalent, particularly shells, scripting hosts, or rundll32.exe.
Substance 3D Designer files arriving from untrusted email senders, cloud links, or non-corporate asset repositories.
Crashes or abnormal termination of Substance 3D Designer correlated with opening a specific asset file.

Detection Strategies

Hunt for process lineage where Substance 3D Designer launches command interpreters such as cmd.exe, powershell.exe, bash, or osascript.
Alert on writes by Substance 3D Designer to autorun locations, Startup folders, scheduled tasks, or LaunchAgents directories.
Inspect endpoint crash telemetry for access violations originating in the Substance 3D Designer process during file open operations.

Monitoring Recommendations

Inventory all hosts running Adobe Substance 3D Designer and track versions against the fixed release published in APSB25-06.
Forward endpoint process, file, and crash telemetry to a centralized analytics platform for correlation across creative workstations.
Monitor outbound network connections from Substance 3D Designer to non-Adobe destinations, which is uncommon during normal operation.

How to Mitigate CVE-2025-21136

Immediate Actions Required

Update Adobe Substance 3D Designer to the version specified in Adobe Security Bulletin APSB25-06.
Restrict opening of Substance 3D Designer files received from external or untrusted sources until patching is verified.
Notify design and 3D content teams to validate the source of any unexpected .sbs, .sbsar, or related asset files.

Patch Information

Adobe released a fixed version of Substance 3D Designer in security bulletin APSB25-06 on January 14, 2025. Administrators should apply the update on all Windows and macOS endpoints running version 14.0 or earlier. Refer to the Adobe Security Bulletin APSB25-06 for the exact fixed version and download links.

Workarounds

Block delivery of Substance 3D Designer project files through email gateways and external file-sharing channels until all endpoints are patched.
Run Substance 3D Designer under a standard user account without local administrator rights to limit post-exploitation impact.
Apply application allowlisting to prevent Substance 3D Designer from launching unexpected child processes such as shells or scripting hosts.

bash

# Verify installed Substance 3D Designer version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Designer" /s | findstr /i version

# Verify installed version on macOS
defaults read "/Applications/Adobe Substance 3D Designer/Adobe Substance 3D Designer.app/Contents/Info.plist" CFBundleShortVersionString