CVE-2025-21155: Adobe Substance 3D Stager DOS Vulnerability

CVE-2025-21155 Overview

CVE-2025-21155 affects Adobe Substance 3D Stager versions 3.1.0 and earlier. The vulnerability is a NULL Pointer Dereference [CWE-476] that results in an application denial-of-service condition. An attacker crafts a malicious file that, when opened by a victim, crashes the Substance 3D Stager process. Exploitation requires local access and user interaction, limiting the scope to workflows involving untrusted 3D asset files. Adobe published the fix in Security Advisory APSB25-09 alongside other February 2025 updates.

Critical Impact
Successful exploitation crashes Adobe Substance 3D Stager, disrupting design workflows and any unsaved work in the affected session.

Affected Products

Adobe Substance 3D Stager 3.1.0 and earlier
Apple macOS installations of Substance 3D Stager
Microsoft Windows installations of Substance 3D Stager

Discovery Timeline

2025-02-11 - CVE-2025-21155 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21155

Vulnerability Analysis

The flaw is a NULL Pointer Dereference [CWE-476] in the file parsing logic of Adobe Substance 3D Stager. When the application processes a specially crafted project or asset file, code paths dereference a pointer that was never initialized or that failed to be set during parsing. The unchecked pointer access triggers an access violation, terminating the process. Because the impact is confined to availability, the vulnerability does not expose scene data, credentials, or memory contents to the attacker. However, an unexpected crash mid-workflow can destroy hours of unsaved artist output.

Root Cause

The root cause is missing validation on a pointer returned by a parsing or object-construction routine. When the malicious file provides malformed structures, the routine returns a null value that downstream code uses without checking. This pattern is common in complex binary format parsers where multiple nested objects must be reconstructed from disk. Adobe's advisory categorizes the issue as CWE-476 without disclosing the specific file format or code path.

Attack Vector

Exploitation is local and requires user interaction. An attacker must deliver a malicious Substance 3D Stager project file, asset, or supported import format to the victim through phishing, shared asset libraries, marketplace downloads, or supply-chain compromise of a 3D content pipeline. The victim then opens the file in Substance 3D Stager 3.1.0 or earlier, triggering the crash. No network exposure, elevated privileges, or subsequent code execution results from this flaw.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. See the Adobe Security Advisory APSB25-09 for vendor technical details.

Detection Methods for CVE-2025-21155

Indicators of Compromise

Unexpected termination of Adobe Substance 3D Stager.exe (Windows) or the Adobe Substance 3D Stager process (macOS) shortly after opening a file
Windows Application event log entries showing faulting module reports associated with Substance 3D Stager
macOS crash reports under ~/Library/Logs/DiagnosticReports/ referencing Substance 3D Stager and a null-address access violation
Delivery of Substance 3D project or asset files from untrusted email attachments, chat platforms, or asset marketplaces

Detection Strategies

Alert on repeated abnormal exits of the Substance 3D Stager process across multiple endpoints or users
Correlate file-open telemetry for supported Substance 3D file extensions with subsequent process crashes
Flag Substance 3D asset files received from external senders and executed on workstations running vulnerable versions

Monitoring Recommendations

Inventory installed versions of Adobe Substance 3D Stager to identify hosts running 3.1.0 or earlier
Forward process termination and crash telemetry from creative workstations into a centralized analytics platform
Monitor shared asset repositories and content-delivery paths for unexpected additions of Substance 3D files from unknown authors

How to Mitigate CVE-2025-21155

Immediate Actions Required

Update Adobe Substance 3D Stager to the version specified in Adobe Security Advisory APSB25-09
Instruct designers and artists to avoid opening Substance 3D project or asset files from untrusted sources
Prioritize patching endpoints used by creative teams that regularly exchange 3D assets with external partners

Patch Information

Adobe published the fixed version in Security Advisory APSB25-09. Administrators should apply the update through the Adobe Creative Cloud desktop application or via managed deployment tooling. Verify the installed version reports higher than 3.1.0 after the update completes.

Workarounds

Restrict opening of Substance 3D Stager files to those originating from trusted internal repositories until patching is complete
Enforce application allowlisting policies that require verified file provenance before launching 3D asset editors
Isolate creative workstations from unmanaged file-sharing channels where malicious project files may be delivered

bash

# Verify installed Substance 3D Stager version on Windows
powershell -Command "Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*Substance 3D Stager*' } | Select-Object DisplayName, DisplayVersion"

# Verify installed Substance 3D Stager version on macOS
defaults read "/Applications/Adobe Substance 3D Stager/Adobe Substance 3D Stager.app/Contents/Info.plist" CFBundleShortVersionString