CVE-2025-43583: Adobe Substance 3D Viewer DOS Vulnerability

CVE-2025-43583 Overview

CVE-2025-43583 affects Adobe Substance 3D Viewer version 0.22 and earlier. The flaw is a NULL pointer dereference [CWE-476] that an attacker can trigger by crafting a malicious file. When a user opens the file in the vulnerable application, the dereference causes the process to crash, producing a denial-of-service condition.

Exploitation requires local access and user interaction. The attacker cannot execute code or disclose data through this flaw. Impact is limited to application availability on the victim's workstation.

Critical Impact
An attacker can crash Adobe Substance 3D Viewer by convincing a user to open a malicious 3D asset, disrupting design workflows.

Affected Products

Adobe Substance 3D Viewer version 0.22
Adobe Substance 3D Viewer versions earlier than 0.22
Windows and macOS installations of Substance 3D Viewer within the affected range

Discovery Timeline

2025-07-08 - CVE-2025-43583 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43583

Vulnerability Analysis

The vulnerability is a NULL pointer dereference inside Adobe Substance 3D Viewer's file parsing path. When the application processes a specially crafted 3D asset, it dereferences a pointer that was never initialized or was returned as NULL from a prior allocation or lookup. The dereference triggers an access violation and terminates the process.

The attack vector is local and requires the victim to open a malicious file. The attacker cannot reach the vulnerable code remotely without social engineering. There is no confidentiality or integrity impact; the vulnerability affects availability only.

Adobe published the fix in security advisory APSB25-54. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Root Cause

The root cause is missing validation of a pointer before dereference inside the file-handling logic of Substance 3D Viewer. The parser does not check whether an object, structure, or allocation returned a valid pointer before using it. When a malformed asset drives the parser into this state, the application reads from or writes to address zero and crashes.

Attack Vector

An attacker crafts a malicious file designed to steer the Substance 3D Viewer parser into the vulnerable code path. The attacker delivers the file through email, chat, shared storage, or a web download. When the victim opens the file in a vulnerable version of Substance 3D Viewer, the process crashes.

The technical references do not publish exploitation code for CVE-2025-43583. See the Adobe Security Advisory APSB25-54 for vendor details.

Detection Methods for CVE-2025-43583

Indicators of Compromise

Unexpected crash events for Substance 3D Viewer.exe on Windows or the equivalent macOS binary, correlated with recent file-open activity
Windows Error Reporting (WER) or WerFault.exe entries referencing Substance 3D Viewer with an access violation at or near address 0x00000000
Delivery of unsolicited 3D asset files (for example .glb, .gltf, .fbx, .usd, .sbsar) from untrusted email, chat, or web sources

Detection Strategies

Alert on repeated process termination of Substance 3D Viewer within short time windows on the same host, which may indicate iterative exploitation attempts
Correlate file-download or email-attachment events for 3D asset formats with subsequent Substance 3D Viewer launches and crashes
Inventory installed versions of Adobe Substance 3D Viewer across endpoints and flag any instance at or below version 0.22

Monitoring Recommendations

Collect application crash telemetry and endpoint process events into a centralized data lake for correlation across users and assets
Monitor file-write events in user document and download directories for the arrival of 3D asset files from external sources
Track Adobe advisory feeds, including APSB25-54, and alert when hosts remain on vulnerable Substance 3D Viewer builds after patch release

How to Mitigate CVE-2025-43583

Immediate Actions Required

Upgrade Adobe Substance 3D Viewer to the fixed release identified in Adobe Security Advisory APSB25-54
Inventory all workstations running Substance 3D Viewer and prioritize patching for users who routinely open externally sourced 3D assets
Instruct designers and 3D artists to avoid opening unsolicited .sbsar, .glb, .gltf, .fbx, or .usd files received from unknown senders

Patch Information

Adobe addressed CVE-2025-43583 in the update described in security advisory APSB25-54. Install the fixed version on every system running Substance 3D Viewer 0.22 or earlier. Verify the installed version through the application's About dialog or by checking the installer metadata after upgrade.

Workarounds

Restrict Substance 3D Viewer usage to known-good internal assets until the patch is deployed
Open suspicious 3D files in an isolated virtual machine or sandbox rather than on production workstations
Enforce email and web gateway controls that quarantine 3D asset file types originating from untrusted external domains

bash

# Example: enumerate installed Substance 3D Viewer version on Windows
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s ^
  | findstr /I "Substance 3D Viewer DisplayVersion"