CVE-2025-43570: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-43570 Overview

CVE-2025-43570 is a Use After Free vulnerability [CWE-416] in Adobe Substance 3D Stager versions 3.1.1 and earlier. The flaw can result in arbitrary code execution in the context of the current user. Successful exploitation requires user interaction, as a victim must open a malicious file crafted by an attacker.

Adobe published the vulnerability in the Adobe Security Advisory APSB25-46. The issue affects installations on both Microsoft Windows and Apple macOS. Attackers can leverage this bug to execute code with the privileges of the logged-in user.

Critical Impact
Arbitrary code execution in the context of the current user through a malicious Substance 3D Stager file.

Affected Products

Adobe Substance 3D Stager versions 3.1.1 and earlier
Apple macOS (as a supported platform for the affected application)
Microsoft Windows (as a supported platform for the affected application)

Discovery Timeline

2025-05-13 - CVE-2025-43570 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43570

Vulnerability Analysis

CVE-2025-43570 is a Use After Free flaw in Adobe Substance 3D Stager, a 3D scene design and rendering application. Use After Free conditions occur when a program continues to reference memory after it has been freed. An attacker who controls the contents of that freed memory region can influence program flow.

When Substance 3D Stager parses a malicious project or asset file, memory tied to a freed object can be reallocated with attacker-controlled data. Subsequent access through the dangling pointer allows the attacker to hijack execution. Code then runs with the same privileges as the user opening the file.

Root Cause

The root cause is improper object lifetime management within the file-parsing routines of Substance 3D Stager 3.1.1 and earlier. A reference to a heap object is retained and later dereferenced after the object has been freed. Attackers craft file structures that trigger the free-then-reuse sequence deterministically to achieve controlled memory reuse.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious Substance 3D Stager file through email, chat, a web download, or a shared project. The victim must open the file in a vulnerable version of Stager. No elevated privileges are required to trigger the vulnerability, and successful exploitation yields code execution as the current user.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Adobe Security Advisory APSB25-46 for vendor technical detail.

Detection Methods for CVE-2025-43570

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe on Windows or the equivalent macOS binary, especially command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
Crash dumps or Windows Error Reporting entries referencing Substance 3D Stager following the opening of a .ssa, .sbsar, or other Stager-associated file from an untrusted source.
Outbound network connections initiated by the Stager process to unfamiliar hosts shortly after a file open event.

Detection Strategies

Deploy endpoint behavioral detections that flag process injection or shell spawning originating from Adobe Substance 3D Stager.
Correlate file-open telemetry for Stager project files delivered through email or download with subsequent process creation and network events.
Alert on Substance 3D Stager version strings at or below 3.1.1 reported by software inventory tooling.

Monitoring Recommendations

Monitor process creation, module loads, and memory allocation anomalies for the Stager process across Windows and macOS endpoints.
Ingest Adobe Creative Cloud installer and update logs to track deployment of the fixed Substance 3D Stager release across the fleet.
Track user-driven downloads and email attachments containing Substance 3D file formats for later correlation with endpoint activity.

How to Mitigate CVE-2025-43570

Immediate Actions Required

Update Adobe Substance 3D Stager to the version listed as fixed in Adobe Security Advisory APSB25-46 on all Windows and macOS endpoints.
Instruct users to avoid opening Substance 3D Stager files received from untrusted or unverified sources until patching is complete.
Inventory hosts running Substance 3D Stager 3.1.1 or earlier and prioritize them for remediation.

Patch Information

Adobe released a fixed version of Substance 3D Stager addressing CVE-2025-43570 as documented in Adobe Security Advisory APSB25-46. Apply the update through the Adobe Creative Cloud desktop application or by downloading the fixed installer directly from Adobe. Confirm the installed version after update to ensure the patched build is active.

Workarounds

Restrict execution of Adobe Substance 3D Stager to users who require it and remove it from systems where it is not needed.
Enforce application allow-listing and email attachment filtering to block delivery of Substance 3D file formats from external senders.
Run Stager under standard user accounts without local administrator rights to limit the impact of code execution.

bash

# Verify installed Substance 3D Stager version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion