CVE-2025-54187: Adobe Substance 3D Painter RCE Vulnerability

CVE-2025-54187 Overview

CVE-2025-54187 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Substance 3D Painter versions 11.0.2 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Adobe addressed the issue in security bulletin APSB25-77.

The vulnerability requires user interaction and local file processing, so the attack vector is local. No public exploit code is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.181%, indicating low predicted exploitation likelihood at this time.

Critical Impact
Successful exploitation results in arbitrary code execution under the privileges of the user opening a crafted Substance 3D Painter project file.

Affected Products

Adobe Substance 3D Painter version 11.0.2
Adobe Substance 3D Painter all prior versions
Windows and macOS installations of Substance 3D Painter

Discovery Timeline

2025-08-12 - CVE-2025-54187 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54187

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition within Substance 3D Painter's file parsing logic. When the application processes a malicious project or asset file, it writes data beyond the bounds of an allocated buffer. This memory corruption can overwrite adjacent structures such as function pointers, vtables, or heap metadata.

An attacker who controls the contents of the malicious file can shape the out-of-bounds write to achieve arbitrary code execution. Execution occurs in the security context of the user opening the file, granting access to the user's documents, credentials, and network resources. The impact on confidentiality, integrity, and availability is high.

Adobe has not published technical specifics about the vulnerable parser or file format component. See the Adobe Security Update APSB25-77 for the official advisory.

Root Cause

The root cause is missing or incorrect bounds checking when Substance 3D Painter deserializes structured data from a file. The application trusts size or offset fields without validating them against the destination buffer, allowing a crafted file to trigger a write past the buffer boundary [CWE-787].

Attack Vector

Exploitation requires social engineering. An attacker delivers a malicious Substance 3D Painter project, texture, or asset file through email, file sharing, a project repository, or a compromised content distribution channel. The victim must open the file in Substance 3D Painter for the vulnerable parser to execute and trigger the out-of-bounds write.

The vulnerability cannot be triggered remotely without user interaction, and it does not provide privilege escalation beyond the current user's rights.

Detection Methods for CVE-2025-54187

Indicators of Compromise

Unexpected child processes spawned by Substance 3D Painter.exe or the macOS equivalent, such as cmd.exe, powershell.exe, or /bin/sh
Crashes or abnormal termination of Substance 3D Painter immediately after opening a third-party project file
Substance 3D Painter writing executable content or scripts to user-writable directories such as %TEMP%, %APPDATA%, or ~/Library
Outbound network connections initiated by the Substance 3D Painter process to unfamiliar hosts following file open events

Detection Strategies

Monitor process lineage for Substance 3D Painter spawning shells, scripting interpreters, or LOLBins
Alert on memory access violations or Windows Error Reporting events involving the Substance 3D Painter binary
Inspect inbound file shares and email attachments for Substance project files (.spp, .sbsar, .sbs) originating from untrusted sources

Monitoring Recommendations

Centralize endpoint process and file telemetry from workstations used by 3D artists, game developers, and VFX teams
Track installed versions of Substance 3D Painter across the fleet and flag systems running 11.0.2 or earlier
Correlate file-open events for Substance project formats with subsequent process creation and outbound network activity

How to Mitigate CVE-2025-54187

Immediate Actions Required

Update Adobe Substance 3D Painter to the fixed version identified in Adobe Security Update APSB25-77
Inventory all endpoints with Substance 3D Painter installed and prioritize creative and engineering workstations
Instruct users to avoid opening Substance project files received from untrusted sources until patching is complete

Patch Information

Adobe published security bulletin APSB25-77, which addresses CVE-2025-54187 in a version newer than 11.0.2. Administrators should deploy the updated installer through Adobe Creative Cloud or their managed software distribution tooling. Verify the installed version after deployment to confirm remediation.

Workarounds

Restrict opening of Substance 3D Painter files to those originating from internal, trusted asset repositories
Run Substance 3D Painter under a standard user account, never with administrative privileges, to limit blast radius
Apply application allowlisting to prevent Substance 3D Painter from launching child processes such as shells or scripting engines
Use email and web gateway controls to inspect and quarantine Substance project file extensions from external senders

bash

# Windows: query installed Substance 3D Painter version via PowerShell
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -like 'Adobe Substance 3D Painter*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation