CVE-2025-49571: Adobe Substance 3D Modeler RCE Flaw

CVE-2025-49571 Overview

CVE-2025-49571 affects Adobe Substance 3D Modeler versions 1.22.0 and earlier. The flaw is an Uncontrolled Search Path Element vulnerability [CWE-427] that allows arbitrary code execution in the context of the current user. An attacker who places a malicious binary or library in a location the application searches can have that code executed by the vulnerable process. Exploitation requires user interaction to launch the application, but no further interaction once the malicious file is staged. Adobe published Security Advisory APSB25-76 describing the issue and providing a fixed release.

Critical Impact
Successful exploitation results in arbitrary code execution under the privileges of the user running Substance 3D Modeler, enabling persistence, data theft, or lateral movement on the host.

Affected Products

Adobe Substance 3D Modeler version 1.22.0
Adobe Substance 3D Modeler all prior releases (earlier than 1.22.0)
Windows and macOS installations of the affected application

Discovery Timeline

2025-08-12 - CVE-2025-49571 published to the National Vulnerability Database
2025-08-13 - Last updated in NVD database

Technical Details for CVE-2025-49571

Vulnerability Analysis

The vulnerability is classified under [CWE-427] Uncontrolled Search Path Element. Substance 3D Modeler resolves certain critical resources, including dynamically loaded libraries or helper executables, using a search path the attacker can influence. When the application starts or loads a module, the operating system loader walks directories in a defined order. If an attacker-controlled directory appears before the legitimate location, the loader binds the malicious file instead. The result is arbitrary code execution inside the trusted Substance 3D Modeler process.

The attack vector is local and requires user interaction, since the victim must execute the application after the malicious resource is staged. No privileges are required on the target system prior to exploitation. Confidentiality, integrity, and availability impacts are all high because the injected code runs with the full rights of the current user.

Root Cause

The root cause is improper qualification of paths used to locate executable code or libraries. The application relies on relative paths, the current working directory, or writable directories that appear in the search order. Without absolute path resolution and signature validation, the loader cannot distinguish a legitimate dependency from an attacker-supplied one.

Attack Vector

An attacker first plants a malicious DLL, dylib, or executable in a directory included in the application's search path. Common vectors include the current working directory of a project file, the Downloads folder, or a removable media volume. When the user opens a Substance 3D Modeler project from that location, the vulnerable process loads the planted file and executes attacker-controlled code. No verified public proof-of-concept exploit is available at the time of writing. See the Adobe Security Advisory APSB25-76 for vendor technical details.

Detection Methods for CVE-2025-49571

Indicators of Compromise

Unsigned or unexpected DLL, .dylib, or executable files written to directories adjacent to Substance 3D Modeler project files
Modeler.exe or related Substance 3D Modeler processes loading modules from user-writable paths such as Downloads, Temp, or removable drives
Child processes spawned by Substance 3D Modeler that do not match normal application behavior, such as cmd.exe, powershell.exe, or scripting hosts

Detection Strategies

Monitor image-load events for the Substance 3D Modeler process and flag libraries loaded from non-standard installation directories
Alert on file-write events that place executable content into directories preceding the application's install path in DLL search order
Correlate process-creation telemetry to identify Substance 3D Modeler launching unexpected interpreters or living-off-the-land binaries

Monitoring Recommendations

Enable EDR module-load and process-lineage telemetry on workstations where Adobe Substance 3D Modeler is installed
Track integrity of the Substance 3D Modeler installation directory and compare loaded module hashes against the vendor-signed baseline
Review endpoint logs for project files opened from removable media or network shares prior to anomalous process activity

How to Mitigate CVE-2025-49571

Immediate Actions Required

Update Adobe Substance 3D Modeler to the version specified in Adobe Security Advisory APSB25-76
Restrict write permissions on the Substance 3D Modeler installation directory and any directories searched during module resolution
Instruct users to open project files only from trusted, controlled directories rather than Downloads or removable media

Patch Information

Adobe addressed CVE-2025-49571 in the release identified in Adobe Security Advisory APSB25-76. Administrators should deploy the updated installer to all endpoints running version 1.22.0 or earlier. Verify the patch by confirming the application version after installation and validating that the vendor-signed binaries match Adobe's published hashes.

Workarounds

Remove or relocate any writable directories from the application's effective search path until the patch is deployed
Apply application allowlisting to block execution of unsigned binaries from user profile directories
Run Substance 3D Modeler under a standard user account with no administrative rights to limit the blast radius of successful exploitation

bash

# Verify installed Substance 3D Modeler version on Windows
(Get-Item "C:\Program Files\Adobe\Adobe Substance 3D Modeler\Modeler.exe").VersionInfo.ProductVersion

# Identify world-writable directories preceding the install path (macOS)
ls -ld /Applications/Adobe\ Substance\ 3D\ Modeler.app/Contents/MacOS