CVE-2025-43551: Adobe Substance 3D Stager Information Disclosure

CVE-2025-43551 Overview

CVE-2025-43551 is an out-of-bounds read vulnerability in Adobe Substance 3D Stager versions 3.1.1 and earlier. The flaw allows disclosure of sensitive process memory when a user opens a crafted file. Attackers can leverage the leaked memory contents to bypass exploit mitigations such as Address Space Layout Randomization (ASLR). Exploitation requires local user interaction, specifically opening a malicious file in the affected application. The issue is classified under [CWE-125] Out-of-Bounds Read and affects deployments on both Microsoft Windows and Apple macOS. Adobe published the fix in security bulletin APSB25-46.

Critical Impact
Attackers who convince a victim to open a malicious asset file can read out-of-bounds memory and defeat ASLR, enabling reliable follow-on exploitation of other memory corruption issues.

Affected Products

Adobe Substance 3D Stager versions 3.1.1 and earlier
Microsoft Windows installations of Substance 3D Stager
Apple macOS installations of Substance 3D Stager

Discovery Timeline

2025-05-13 - CVE-2025-43551 published to NVD alongside Adobe advisory APSB25-46
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43551

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the file parsing logic of Adobe Substance 3D Stager. When the application processes a specially crafted project or asset file, it reads memory beyond the intended buffer boundary. The returned bytes can contain pointers, heap metadata, or other sensitive process data. Attackers use this leaked information to defeat ASLR by disclosing the base addresses of loaded modules or the heap. On its own, the flaw does not corrupt memory or execute code. Paired with a separate memory corruption bug, however, the leak transforms an unreliable exploit attempt into a deterministic one. The confidentiality impact is high, while integrity and availability are unaffected. The attack surface is limited to local file open operations initiated by the victim.

Root Cause

The root cause is missing or insufficient bounds checking during deserialization of untrusted file structures. The parser calculates a read length or index from attacker-controlled fields without validating it against the actual buffer size, producing a read past the allocated region. This pattern is characteristic of [CWE-125] Out-of-Bounds Read defects in native C or C++ file parsers.

Attack Vector

Exploitation requires the victim to open a malicious Substance 3D Stager file delivered through email, chat, a shared drive, or a compromised asset marketplace. No network exposure or elevated privileges are needed. Once opened, the parser leaks memory contents that the attacker recovers through application behavior, error output, or a chained exploit component embedded in the same file.

No public proof-of-concept or exploit code is available at this time. Refer to the Adobe Security Advisory APSB25-46 for vendor technical details.

Detection Methods for CVE-2025-43551

Indicators of Compromise

Substance 3D Stager processes that crash or produce access-violation exceptions shortly after opening a file from an untrusted source
Unexpected Stager.exe child processes or outbound network connections following the opening of a .sbs, .ssg, or related asset file
Substance 3D Stager files delivered from external senders, cloud storage links, or non-corporate asset repositories

Detection Strategies

Monitor endpoint telemetry for Substance 3D Stager process crashes correlated with recent file-open events
Alert on Substance 3D Stager writing or executing files outside of its normal project directories
Inspect email and web gateways for Substance 3D asset file types originating from untrusted external sources

Monitoring Recommendations

Enable Windows Error Reporting and macOS crash log forwarding to a central SIEM to catch parser faults
Track installed versions of Adobe Substance 3D Stager across the fleet and flag hosts running 3.1.1 or earlier
Correlate file-download events with subsequent Substance 3D Stager launches to identify high-risk open operations

How to Mitigate CVE-2025-43551

Immediate Actions Required

Upgrade Adobe Substance 3D Stager to the version listed as fixed in Adobe advisory APSB25-46
Inventory all Windows and macOS endpoints running Substance 3D Stager and prioritize patching workstations used by 3D artists and designers
Instruct users to open Substance 3D files only from trusted internal repositories until patching completes

Patch Information

Adobe released a patched version of Substance 3D Stager in security bulletin APSB25-46 published on 2025-05-13. Administrators should deploy the update through the Adobe Creative Cloud desktop application or the enterprise Admin Console. Verify successful installation by checking the application version reports a build newer than 3.1.1.

Workarounds

Restrict Substance 3D Stager file associations so that double-click opening from email attachments or downloads is disabled
Block inbound Substance 3D asset file types at email and web gateways for users who do not require them
Apply application allowlisting to prevent Substance 3D Stager from spawning shell or scripting interpreters

bash

# Example: query installed Substance 3D Stager version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Stager" /s /v Version

# Example: query installed Substance 3D Stager version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Stager.app"