CVE-2025-43553: Adobe Substance 3D Modeler RCE Flaw

CVE-2025-43553 Overview

CVE-2025-43553 affects Adobe Substance 3D Modeler versions 1.21.0 and earlier. The flaw is an Uncontrolled Search Path Element weakness [CWE-427] that can lead to arbitrary code execution in the context of the current user. An attacker who controls a resource in the application's search path can force Substance 3D Modeler to load a malicious library or executable at runtime. Exploitation requires user interaction: the victim must open a crafted file in the vulnerable application. Adobe published the issue under security bulletin APSB25-51.

Critical Impact
Arbitrary code execution as the logged-in user after opening a malicious file, enabling persistence, credential theft, or lateral movement from the workstation.

Affected Products

Adobe Substance 3D Modeler 1.21.0
Adobe Substance 3D Modeler all prior versions
Windows and macOS installations of Substance 3D Modeler

Discovery Timeline

2025-05-13 - CVE-2025-43553 published to NVD
2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-43553

Vulnerability Analysis

The vulnerability is classified as an Uncontrolled Search Path Element [CWE-427]. Substance 3D Modeler resolves at least one critical resource, such as a dynamic library or helper executable, using a search path that includes attacker-influenced locations. When the application starts or opens a project file, the loader walks that search path and binds to the first matching name it finds. An attacker who can place a file with the expected name earlier in the path causes the malicious code to run inside the trusted application process. The resulting code executes with the privileges of the user who launched Substance 3D Modeler.

Root Cause

The root cause is improper restriction of the library and executable search path used by Substance 3D Modeler. The application does not enforce absolute paths or signed-module requirements when resolving dependent components. Common manifestations include DLL search-order hijacking on Windows and dylib hijacking on macOS, both of which fall under [CWE-427].

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted archive or project bundle that includes a malicious library alongside a legitimate-looking Substance 3D Modeler asset. When the victim opens the file from the attacker-controlled directory, Substance 3D Modeler resolves a dependency to the planted library instead of the intended system module. The planted code then runs with the user's privileges, allowing follow-on actions such as downloading additional payloads, harvesting credentials, or establishing persistence. See the Adobe Security Advisory APSB25-51 for vendor details.

Detection Methods for CVE-2025-43553

Indicators of Compromise

Unexpected .dll or .dylib files present in directories containing Substance 3D Modeler project assets or shared with downloaded archives.
Substance 3D Modeler process (Modeler.exe or Adobe Substance 3D Modeler.app) loading modules from user-writable directories such as Downloads, Desktop, or temporary extraction paths.
Child processes spawned by Substance 3D Modeler that are not part of normal application behavior, such as cmd.exe, powershell.exe, bash, or network utilities.

Detection Strategies

Hunt for image loads where the parent process is Substance 3D Modeler and the loaded module path resides outside the official installation directory under Program Files or /Applications.
Correlate file-open telemetry on Substance 3D Modeler project files with subsequent module loads from the same parent directory to identify search-path hijacking attempts.
Flag any newly written executable or library in directories that are also read by Substance 3D Modeler within a short time window.

Monitoring Recommendations

Enable module-load and process-creation logging on workstations used by 3D content and design teams.
Alert on Substance 3D Modeler spawning interpreters, shells, or scripting hosts, which are not expected during normal use.
Track outbound network connections initiated by Substance 3D Modeler to non-Adobe domains for signs of post-exploitation activity.

How to Mitigate CVE-2025-43553

Immediate Actions Required

Upgrade Substance 3D Modeler to the fixed release identified in Adobe Security Advisory APSB25-51.
Instruct users to open Substance 3D Modeler project files only from trusted, controlled directories, never directly from email attachments or extracted archives.
Inventory endpoints with vulnerable versions of Substance 3D Modeler and prioritize patching for creative and design workstations.

Patch Information

Adobe addressed CVE-2025-43553 in the update referenced by bulletin APSB25-51. Install the latest version of Adobe Substance 3D Modeler through the Adobe Creative Cloud desktop application or by downloading the updated installer from Adobe. Confirm post-update that the installed version is later than 1.21.0.

Workarounds

Move downloaded project files into a dedicated, restricted directory before opening them, separating them from any bundled libraries.
Apply application allow-listing to block unsigned .dll and .dylib files from loading into Substance 3D Modeler.
Restrict standard user write access to directories in the Substance 3D Modeler load path through file-system permissions.

bash

# Configuration example: block unsigned module loads into Substance 3D Modeler via Windows Defender Application Control
New-CIPolicy -FilePath C:\Policies\Modeler-WDAC.xml -Level Publisher -ScanPath "C:\Program Files\Adobe\Adobe Substance 3D Modeler" -UserPEs
ConvertFrom-CIPolicy -XmlFilePath C:\Policies\Modeler-WDAC.xml -BinaryFilePath C:\Policies\Modeler-WDAC.bin