CVE-2025-27165: Adobe Substance 3D Stager Disclosure Flaw

CVE-2025-27165 Overview

CVE-2025-27165 is an out-of-bounds read vulnerability [CWE-125] affecting Adobe Substance 3D Stager versions 3.1.2 and earlier. The flaw allows an attacker to read memory outside the intended buffer boundaries when the application parses a malformed file. Exploitation requires user interaction: a victim must open a crafted file supplied by the attacker. Successful exploitation can disclose sensitive memory contents from the affected process, potentially exposing data such as pointer values, cryptographic material, or fragments of other in-process data.

Critical Impact
An attacker who convinces a user to open a malicious 3D asset in Substance 3D Stager can read process memory, leaking sensitive information that may aid further exploitation.

Affected Products

Adobe Substance 3D Stager versions 3.1.2 and earlier
Microsoft Windows installations of Substance 3D Stager
Apple macOS installations of Substance 3D Stager

Discovery Timeline

2025-07-08 - CVE-2025-27165 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27165

Vulnerability Analysis

The vulnerability is classified under CWE-125: Out-of-bounds Read. Substance 3D Stager parses complex 3D scene, asset, and material file formats. When the parser encounters a malformed structure, it reads beyond the allocated buffer boundary. The read data is not sanitized before being processed downstream, which can expose adjacent heap or stack memory contents.

The attack requires local access and user interaction. A victim must open a malicious file for the vulnerable code path to execute. The scope is unchanged, and the impact is limited to confidentiality of process memory. Integrity and availability are not directly affected, according to the Adobe advisory.

Root Cause

The root cause is missing or incorrect bounds validation in a file parsing routine. When a length or offset field in the input file exceeds the size of the allocated buffer, the parser dereferences memory outside the intended region. Improper input validation on attacker-controlled length fields is the underlying weakness.

Attack Vector

An attacker crafts a malicious 3D asset file and delivers it via email, chat, a shared repository, or a compromised website. When the victim opens the file in Substance 3D Stager on Windows or macOS, the vulnerable parser triggers the out-of-bounds read. The leaked memory may be transmitted back to the attacker through a secondary channel or used to defeat address space layout randomization (ASLR) in a follow-up exploit chain.

No public proof-of-concept exploit is available for CVE-2025-27165, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Adobe Security Bulletin APSB25-64 for vendor technical details.

Detection Methods for CVE-2025-27165

Indicators of Compromise

Unexpected Substance 3D Stager process crashes or abnormal termination events when opening files from untrusted sources
Substance 3D Stager processes making outbound network connections shortly after opening a newly received asset file
Presence of unsolicited 3D asset files (.sbs, .sbsar, .stg, .fbx, .obj) delivered by email or messaging platforms

Detection Strategies

Inventory endpoints running Adobe Substance 3D Stager and flag any installation at version 3.1.2 or earlier
Monitor endpoint telemetry for Adobe Substance 3D Stager.exe (Windows) or the macOS equivalent spawning unexpected child processes or exhibiting memory-read anomalies
Correlate file-open events on 3D asset formats with subsequent process crashes to identify potential exploitation attempts

Monitoring Recommendations

Enable file provenance tracking so files downloaded from the internet or received through email carry mark-of-the-web attributes
Log user file-open activity for creative applications and retain telemetry for retrospective hunting
Alert on Substance 3D Stager processes reading or writing to unusual locations such as user credential stores or browser profile directories

How to Mitigate CVE-2025-27165

Immediate Actions Required

Upgrade Adobe Substance 3D Stager to the fixed version identified in Adobe Security Bulletin APSB25-64
Restrict opening of 3D asset files received from untrusted or unverified sources until patching is complete
Communicate to designers and 3D artists that opening unsolicited asset files can expose sensitive process memory

Patch Information

Adobe released a security patch addressing CVE-2025-27165 as part of bulletin APSB25-64. Administrators should deploy the updated version of Substance 3D Stager on both Windows and macOS endpoints. Refer to the Adobe Security Patch APSB25-64 advisory for exact fixed version numbers and download links.

Workarounds

Block or quarantine 3D asset file types at the email gateway when senders are external or unknown
Enforce application allowlisting so that Substance 3D Stager runs only under monitored user contexts
Apply operating system exploit mitigations such as ASLR and Data Execution Prevention (DEP) to reduce the value of leaked memory in follow-on attacks

bash

# Windows: Check installed Substance 3D Stager version via PowerShell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Adobe Substance 3D Stager*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation