CVE-2025-54186: Adobe Substance 3D Modeler Disclosure Flaw

CVE-2025-54186 Overview

CVE-2025-54186 is an out-of-bounds read vulnerability in Adobe Substance 3D Modeler versions 1.22.0 and earlier. The flaw allows an attacker to read memory outside the bounds of an allocated buffer, leading to disclosure of sensitive process memory. Exploitation requires user interaction: a victim must open a crafted malicious file in the affected application. The issue is tracked under CWE-125 and documented in Adobe Security Advisory APSB25-76.

Critical Impact
An attacker can disclose sensitive memory contents from the Substance 3D Modeler process, potentially exposing data useful for bypassing exploit mitigations such as ASLR.

Affected Products

Adobe Substance 3D Modeler 1.22.0
Adobe Substance 3D Modeler prior versions
Windows and macOS installations of the affected releases

Discovery Timeline

2025-08-12 - CVE-2025-54186 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54186

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] triggered during parsing of a malformed file in Adobe Substance 3D Modeler. When the application processes attacker-controlled input, it reads past the end of an allocated buffer. The resulting memory contents can be returned to the attacker or reflected into application state that leaks data.

Exploitation is local and requires a victim to open the malicious file. There is no impact to integrity or availability, but confidentiality impact is high because arbitrary process memory can be exposed. Disclosed memory frequently contains pointers, cryptographic material, or file contents useful for chaining additional attacks.

At publication, no public proof-of-concept exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.202%.

Root Cause

The root cause is insufficient bounds validation when the file parser reads structured data from an untrusted 3D asset. A length or offset field controlled by the input file is trusted without validation against the actual buffer size, allowing the read to extend beyond allocated memory.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious project or asset file and delivers it through email, a shared workspace, a marketplace, or a compromised website. When the victim opens the file in a vulnerable Substance 3D Modeler build, the parser triggers the out-of-bounds read and leaks memory back to attacker-controlled structures.

The vulnerability manifests during file parsing. See the Adobe Security Advisory APSB25-76 for vendor technical details.

Detection Methods for CVE-2025-54186

Indicators of Compromise

Unexpected crashes or hangs in Adobe Substance 3D Modeler.exe immediately after opening a third-party asset
Substance 3D Modeler processes spawning outbound network connections shortly after file open events
Anomalous read access patterns from the Modeler process against unrelated memory regions or files

Detection Strategies

Inventory endpoints running Adobe Substance 3D Modeler and flag installations at version 1.22.0 or earlier
Alert on Substance 3D project files delivered via email, chat, or unmanaged file shares
Correlate file-open telemetry with process anomalies such as crashes, unusual child processes, or memory access violations

Monitoring Recommendations

Enable process and file telemetry on workstations used by 3D artists and design teams
Monitor for user-driven downloads of Substance 3D asset formats from untrusted sources
Track patch compliance against Adobe Security Advisory APSB25-76

How to Mitigate CVE-2025-54186

Immediate Actions Required

Upgrade Adobe Substance 3D Modeler to the fixed release identified in Adobe Security Advisory APSB25-76
Instruct users to open Substance 3D files only from trusted, verified sources
Prioritize patching on workstations that handle assets from external vendors, contractors, or marketplaces

Patch Information

Adobe published fixed builds in Adobe Security Advisory APSB25-76. Administrators should deploy the update through the Adobe Creative Cloud desktop client or their standard software distribution tooling and verify the installed version is later than 1.22.0.

Workarounds

Block or quarantine Substance 3D project files received from untrusted email senders or external file shares
Restrict use of Adobe Substance 3D Modeler on shared or high-value systems until patching completes
Apply application allowlisting to prevent execution of unauthorized Substance 3D asset files

bash

# Verify installed Substance 3D Modeler version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Modeler" /v Version