CVE-2025-43569: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-43569 Overview

CVE-2025-43569 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Substance 3D Stager versions 3.1.1 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a maliciously crafted file. Adobe disclosed the issue in security bulletin APSB25-46 on May 13, 2025.

Exploitation requires local user interaction, limiting remote attack scenarios. However, attackers can weaponize the bug through phishing campaigns delivering trojanized 3D asset files. The vulnerability impacts both Windows and macOS installations of the design application.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the logged-in user, enabling malware deployment, credential theft, and lateral movement.

Affected Products

Adobe Substance 3D Stager versions 3.1.1 and earlier
Microsoft Windows installations of Substance 3D Stager
Apple macOS installations of Substance 3D Stager

Discovery Timeline

2025-05-13 - Adobe publishes security bulletin APSB25-46
2025-05-13 - CVE-2025-43569 published to NVD
2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-43569

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition classified under [CWE-787]. Out-of-bounds write flaws occur when software writes data past the boundaries of an allocated memory buffer. The write corrupts adjacent memory structures, including function pointers, virtual table entries, or return addresses.

In Substance 3D Stager, the flaw triggers during the parsing of file format structures. An attacker controls the malformed input that drives the out-of-bounds write operation. The corrupted memory state can be steered toward arbitrary code execution through standard memory corruption exploitation techniques.

The vulnerability scope is unchanged, meaning the exploited component and the impacted component share the same security authority. Confidentiality, integrity, and availability impacts are all high because code execution gives the attacker full control over the user session.

Root Cause

The root cause is missing or insufficient bounds checking when Substance 3D Stager processes attacker-controlled data from a project or asset file. The application writes data to a buffer using an index or length value derived from the file without validating it against the buffer size. Adobe has not published the specific parsing function or file format component responsible for the flaw.

Attack Vector

The attack vector is local and requires user interaction. An attacker must deliver a crafted file to the victim and convince them to open it in Substance 3D Stager. Common delivery channels include email attachments, malicious downloads from compromised asset marketplaces, and shared project repositories. No prior authentication or elevated privileges are required on the target system.

The vulnerability mechanism is described in prose only. No verified public proof-of-concept code is available. Refer to the Adobe Security Advisory APSB25-46 for vendor-supplied technical context.

Detection Methods for CVE-2025-43569

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe or the macOS equivalent, particularly shells, scripting engines, or rundll32.exe.
Crash dumps or Windows Error Reporting events referencing Substance 3D Stager modules following the opening of a third-party asset file.
New persistence entries (Run keys, scheduled tasks, LaunchAgents) created shortly after Substance 3D Stager activity.
Outbound network connections initiated by the Substance 3D Stager process to non-Adobe infrastructure.

Detection Strategies

Monitor process lineage to flag any non-standard child processes descending from Substance 3D Stager.
Apply behavioral detection rules for memory corruption indicators such as access violations followed by suspicious code execution.
Correlate file open events for .ssa, .sbsar, and other Substance project formats with subsequent process or network anomalies.

Monitoring Recommendations

Track installed versions of Substance 3D Stager across endpoints and alert when versions at or below 3.1.1 are detected.
Audit email gateways and file-sharing platforms for inbound Substance 3D project files from untrusted senders.
Enable endpoint logging for image and module loads inside the Substance 3D Stager process to identify exploitation attempts.

How to Mitigate CVE-2025-43569

Immediate Actions Required

Update Adobe Substance 3D Stager to the version released in advisory APSB25-46 on all Windows and macOS endpoints.
Inventory design and creative workstations to identify any remaining installations of version 3.1.1 or earlier.
Instruct designers and 3D artists to avoid opening Substance 3D project files received from untrusted or unverified sources.

Patch Information

Adobe released fixed builds alongside security bulletin APSB25-46 on May 13, 2025. Administrators should consult the Adobe Security Advisory APSB25-46 for the exact patched version numbers and download links for both Windows and macOS platforms.

Workarounds

Restrict Substance 3D Stager usage to systems running standard user accounts rather than administrative accounts to limit the impact of successful exploitation.
Block inbound delivery of Substance 3D project file extensions at email and web gateways until patching is complete.
Apply application allowlisting policies that prevent Substance 3D Stager from launching unauthorized child processes.

bash

# Example: identify Substance 3D Stager installations on Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Adobe Substance 3D Stager*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation