CVE-2025-47108: Adobe Substance 3D Painter RCE Vulnerability

CVE-2025-47108 Overview

CVE-2025-47108 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Substance 3D Painter versions 11.0.1 and earlier. The flaw can lead to arbitrary code execution in the context of the user running the application. Exploitation requires user interaction: the victim must open a malicious file crafted by an attacker. Adobe addressed the issue in security advisory APSB25-58.

Critical Impact
Successful exploitation grants arbitrary code execution under the current user's privileges, enabling malware installation, data theft, or lateral movement on the host.

Affected Products

Adobe Substance 3D Painter 11.0.1
Adobe Substance 3D Painter earlier than 11.0.1
Windows and macOS installations of Substance 3D Painter

Discovery Timeline

2025-06-10 - CVE-2025-47108 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47108

Vulnerability Analysis

The vulnerability is classified under [CWE-787] Out-of-Bounds Write. Substance 3D Painter writes data past the boundary of an allocated buffer when parsing untrusted file content. The corruption occurs during file processing operations performed by the application. Adversaries can shape the malformed input to overwrite adjacent memory structures, including function pointers or return addresses. This primitive enables arbitrary code execution within the user's security context. Because Substance 3D Painter often runs with standard user rights on creative workstations, a successful attack inherits those privileges and full access to user data.

Root Cause

The root cause is missing or insufficient validation of size and offset values during parsing of a Substance 3D Painter project or asset file. When the application processes attacker-controlled fields, it writes beyond the bounds of a fixed-length buffer. Adobe has not published the exact file format component affected. The vendor advisory APSB25-58 lists the issue as resolved in versions following 11.0.1.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted project file, texture asset, or other supported format through email, file sharing services, or compromised content repositories. The victim must open the file in Substance 3D Painter to trigger the vulnerable parsing path. Network exploitation is not possible without first placing the file on the target system.

No public proof-of-concept code is available. Refer to the Adobe Security Advisory APSB25-58 for vendor technical details.

Detection Methods for CVE-2025-47108

Indicators of Compromise

Unexpected child processes spawned by Substance 3D Painter.exe or the macOS bundle, particularly shells, scripting interpreters, or rundll32.exe
Substance 3D Painter writing executables, scripts, or scheduled task entries to user-writable directories
Crashes or abnormal termination of Substance 3D Painter immediately after opening a project or asset file from an external source

Detection Strategies

Inventory endpoints to identify installations of Substance 3D Painter 11.0.1 or earlier and flag them for patching
Build behavioral rules that alert on creative applications spawning command interpreters or network connections shortly after file open events
Hunt for project files and texture assets received from untrusted senders or downloaded from unverified sources in the days preceding any suspicious activity

Monitoring Recommendations

Log process creation events with parent-child relationships on workstations used for 3D content creation
Monitor file write events originating from Substance 3D Painter to autostart locations, user profile binaries, and Office template directories
Capture endpoint telemetry on outbound network connections initiated by the Substance 3D Painter process after file open operations

How to Mitigate CVE-2025-47108

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to the fixed version identified in Adobe Security Advisory APSB25-58
Instruct users to avoid opening Substance 3D Painter project files, textures, or assets received from untrusted or unverified sources
Enforce least-privilege on creative workstations so a compromised user session cannot escalate to administrative access

Patch Information

Adobe published security advisory APSB25-58 addressing CVE-2025-47108 in Substance 3D Painter. Versions after 11.0.1 contain the fix. Administrators should validate the installed version through Creative Cloud or the application's About dialog and deploy updates through standard software distribution channels. Full vendor remediation guidance is available in the Adobe Security Advisory APSB25-58.

Workarounds

Restrict execution of Substance 3D Painter to systems where users only open files from trusted, internally vetted sources until patching is complete
Apply application allowlisting and block opening of files originating from email attachments or web downloads in Substance 3D Painter
Segment 3D content creation workstations from sensitive corporate resources to limit blast radius if exploitation occurs

bash

# Configuration example: verify installed version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Painter" /v Version

# macOS: inspect installed version
defaults read "/Applications/Adobe Substance 3D Painter/Adobe Substance 3D Painter.app/Contents/Info.plist" CFBundleShortVersionString