CVE-2025-24450: Adobe Substance 3D Painter RCE Vulnerability

CVE-2025-24450 Overview

CVE-2025-24450 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Substance 3D Painter versions 10.1.2 and earlier. The flaw allows attackers to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file crafted by an attacker. Adobe addressed the issue in security advisory APSB25-18.

Critical Impact
Successful exploitation grants attackers arbitrary code execution at the privilege level of the user running Substance 3D Painter, enabling malware installation, data theft, and lateral movement.

Affected Products

Adobe Substance 3D Painter 10.1.2 and earlier
Windows installations of Substance 3D Painter
macOS installations of Substance 3D Painter

Discovery Timeline

2025-03-11 - CVE-2025-24450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24450

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in Adobe Substance 3D Painter. Out-of-bounds writes occur when an application writes data past the end, or before the beginning, of an allocated buffer. In Substance 3D Painter, the flaw is reachable through file parsing logic that handles user-supplied project or asset files.

An attacker who controls the structure of an input file can corrupt adjacent memory regions. By shaping the corruption, the attacker can overwrite control data such as function pointers or object virtual tables. This pivot from memory corruption to control-flow hijack enables arbitrary code execution in the user's security context.

The EPSS score is 0.236% with a percentile of 14.371, indicating low predicted likelihood of exploitation activity in the near term. No public proof-of-concept exists at this time, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is insufficient bounds checking during the parsing of attacker-controlled file content. The application trusts size or offset fields embedded in the input without validating them against the actual destination buffer size before performing memory writes.

Attack Vector

The attack vector is local and requires user interaction. An attacker must deliver a malicious Substance 3D Painter project file or asset through phishing, a compromised website, a shared asset repository, or a marketplace. The victim triggers the vulnerability by opening the file in a vulnerable version of the application. No authentication or elevated privileges are required on the attacker side.

No verified proof-of-concept code is publicly available. Refer to the Adobe Security Advisory APSB25-18 for vendor-supplied technical context.

Detection Methods for CVE-2025-24450

Indicators of Compromise

Substance 3D Painter process (Adobe Substance 3D Painter.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or bash
Unexpected outbound network connections originating from the Substance 3D Painter process shortly after opening a project file
Creation of executables, scripts, or scheduled tasks by the Substance 3D Painter process
Substance 3D Painter project files (.spp, .spt, .sbsar) arriving from untrusted email, chat, or download sources

Detection Strategies

Hunt for anomalous child process creation chains where Substance 3D Painter is the parent process
Monitor file access patterns where Substance 3D Painter writes to startup folders, registry run keys, or scheduled task directories
Correlate file-open events with subsequent process injection, credential access, or persistence behaviors
Apply behavioral identification rules that flag process crashes followed by code execution from the same image

Monitoring Recommendations

Centralize endpoint process telemetry from creative workstations running Substance 3D Painter into a SIEM or data lake
Track installed versions of Substance 3D Painter across the fleet and alert on hosts still running 10.1.2 or earlier
Inspect inbound email attachments and download proxies for Substance 3D Painter project file formats from external senders
Enable crash reporting on workstations so memory corruption events surface for triage rather than being silently dismissed

How to Mitigate CVE-2025-24450

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to the fixed release identified in Adobe Security Advisory APSB25-18
Inventory all endpoints with Substance 3D Painter installed and prioritize patching for users handling externally sourced assets
Instruct users to refuse Substance 3D Painter project files from unverified senders or marketplaces until patching is complete
Validate that endpoint protection is active on creative workstations, which are frequently excluded from baseline policies due to performance concerns

Patch Information

Adobe published the fix in security bulletin APSB25-18. Administrators should apply the vendor-supplied update to all installations of Substance 3D Painter 10.1.2 and earlier. The advisory lists the minimum fixed version and platform-specific download locations.

Workarounds

Restrict opening Substance 3D Painter files to known internal sources until the patch is applied
Run Substance 3D Painter under a standard user account, never under administrative privileges, to limit post-exploitation impact
Apply application allowlisting to prevent unexpected child processes from launching from Substance 3D Painter
Segment creative workstations from sensitive infrastructure to contain potential post-exploitation activity

bash

# Configuration example: query installed Substance 3D Painter version on Windows
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Substance 3D Painter"

# On macOS
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Painter.app"