CVE-2025-49572: Adobe Substance 3D Modeler RCE Vulnerability

CVE-2025-49572 Overview

CVE-2025-49572 affects Adobe Substance 3D Modeler versions 1.22.0 and earlier. The flaw is an out-of-bounds write vulnerability [CWE-787] that allows arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file crafted by the attacker.

Adobe published the fix in security advisory APSB25-76 on August 12, 2025. The vulnerability carries a CVSS 3.1 base score of 7.8 and is exploitable locally without privileges. No public proof-of-concept code exists, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation grants arbitrary code execution under the privileges of the user running Substance 3D Modeler, enabling malware deployment, credential theft, or lateral movement from artist and design workstations.

Affected Products

Adobe Substance 3D Modeler version 1.22.0
Adobe Substance 3D Modeler all prior versions
Windows and macOS installations of the affected versions

Discovery Timeline

2025-08-12 - Adobe releases security advisory APSB25-76 with patched build
2025-08-12 - CVE-2025-49572 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49572

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in Adobe Substance 3D Modeler's file parsing logic. Substance 3D Modeler imports several 3D model and scene formats. When the application parses a malformed file, it writes data past the bounds of an allocated buffer. This corruption can overwrite adjacent memory structures, including function pointers, virtual table entries, or heap metadata.

An attacker who controls the contents written out of bounds can redirect execution to attacker-supplied shellcode. Because the process runs at the privileges of the interactive user, the resulting code execution inherits those privileges. Adobe has not released technical details on the specific parser or file format involved beyond the advisory APSB25-76.

Root Cause

The defect originates in missing or insufficient bounds checking when handling fields inside a project or asset file. The parser trusts size or index values from the file header without validating them against the destination buffer. This pattern is common across native C++ 3D content pipelines that prioritize parsing speed.

Attack Vector

Exploitation requires a victim to open a malicious .sbsmdl or related Substance project file. Attackers deliver the file through phishing emails, compromised asset marketplaces, supply chain injection into shared project repositories, or instant messaging in design teams. The attack vector is local with low complexity, no privileges required, and user interaction required.

No verified exploit code is publicly available. The technical mechanism is described in the Adobe advisory referenced below; see Adobe Security Advisory APSB25-76 for vendor details.

Detection Methods for CVE-2025-49572

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Modeler.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Substance 3D Modeler process making outbound network connections to non-Adobe domains shortly after opening a project file
Crashes or Windows Error Reporting events tied to the Modeler process when opening untrusted 3D assets
Newly created executables or scripts written to user-writable paths by the Modeler process

Detection Strategies

Monitor for process tree anomalies where Substance 3D Modeler spawns interpreters, shells, or LOLBins
Inspect file ingestion telemetry for Substance project files originating from email attachments, browser downloads, or removable media
Apply YARA rules against Substance project files staged in shared storage to flag malformed structural fields
Correlate Modeler crashes with subsequent persistence events such as registry Run key writes or scheduled task creation

Monitoring Recommendations

Enable command-line and process creation auditing on workstations running Adobe Substance 3D Modeler
Forward endpoint telemetry to a centralized data lake for behavioral analytics across the design and content creation fleet
Track installed versions of Substance 3D Modeler through software inventory to confirm patch coverage above 1.22.0
Alert on Substance 3D Modeler executing from non-standard installation paths or with unsigned modules loaded

How to Mitigate CVE-2025-49572

Immediate Actions Required

Upgrade Adobe Substance 3D Modeler to the version specified in Adobe Security Advisory APSB25-76
Inventory all endpoints running Substance 3D Modeler 1.22.0 or earlier and prioritize them for patching
Instruct design and 3D content teams to avoid opening Substance project files from untrusted sources until patched
Block inbound email attachments with Substance project file extensions at the secure email gateway pending remediation

Patch Information

Adobe addressed CVE-2025-49572 in the update published with advisory APSB25-76 on August 12, 2025. Administrators should deploy the patched build through the Adobe Creative Cloud desktop application or managed software distribution. Full vendor guidance is available at Adobe Security Advisory APSB25-76.

Workarounds

Restrict execution of Substance 3D Modeler to dedicated workstations isolated from sensitive corporate networks
Enforce least-privilege user accounts so exploitation does not yield administrative rights
Open untrusted 3D assets only inside a sandboxed virtual machine without persistent storage or credential access
Apply application allowlisting to prevent Substance 3D Modeler from launching child processes such as shells or scripting hosts

bash

# Verify installed Substance 3D Modeler version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Modeler" /v Version

# Verify installed Substance 3D Modeler version on macOS
defaults read "/Applications/Adobe Substance 3D Modeler.app/Contents/Info.plist" CFBundleShortVersionString