CVE-2025-54189: Adobe Substance 3D Painter Disclosure Flaw

CVE-2025-54189 Overview

CVE-2025-54189 is an out-of-bounds read vulnerability in Adobe Substance 3D Painter versions 11.0.2 and earlier. The flaw resides in the application's file parsing routines and allows an attacker to read memory outside allocated buffer boundaries. Exploitation requires user interaction, specifically that a victim opens a malicious file crafted by the attacker. Successful exploitation can lead to disclosure of sensitive process memory, which may include pointers, credentials, or other data useful for chaining further attacks. Adobe addressed the issue in security bulletin APSB25-77. The vulnerability is classified under CWE-125 (Out-of-bounds Read).

Critical Impact
An attacker can exfiltrate sensitive memory contents from a Substance 3D Painter process when a victim opens a specially crafted project or asset file.

Affected Products

Adobe Substance 3D Painter version 11.0.2
Adobe Substance 3D Painter all prior versions
Windows and macOS installations of the affected releases

Discovery Timeline

2025-08-12 - CVE-2025-54189 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54189

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Adobe Substance 3D Painter's file parsing logic. When the application processes a malformed input file, it reads memory past the intended buffer boundary. The disclosed memory may contain sensitive data such as heap metadata, object pointers, or residual data from other operations. Attackers can use this leaked information to bypass Address Space Layout Randomization (ASLR) or to prepare follow-on exploitation. The issue is local in scope because it requires the victim to open the malicious file within the desktop application. No elevated privileges are required to trigger the read, but the attacker cannot execute code or modify data through this flaw alone.

Root Cause

The root cause is missing or insufficient bounds validation in a file parser [CWE-125]. Substance 3D Painter fails to verify that offsets, lengths, or index values derived from the input file remain within the allocated buffer before dereferencing them. Adobe's advisory APSB25-77 confirms the fix corrects this validation path.

Attack Vector

The attack vector is local and requires user interaction. An attacker distributes a malicious project, texture, mesh, or asset file through email, chat, marketplaces, or supply chain channels. When the victim opens the file in a vulnerable version of Substance 3D Painter, the parser reads out-of-bounds memory. The attacker must combine this primitive with a channel to exfiltrate the leaked data, for example a script that returns memory contents through the application's plugin surface or through observable rendering artifacts. See the Adobe Security Advisory APSB25-77 for vendor details.

Detection Methods for CVE-2025-54189

Indicators of Compromise

Unexpected crashes or hangs of Substance 3D Painter.exe when opening third-party project files.
Untrusted .spp, .sbsar, .sbs, or texture asset files delivered from external sources or unfamiliar marketplaces.
Substance 3D Painter processes spawning unusual child processes or performing outbound network connections after opening a file.

Detection Strategies

Inventory endpoints running Adobe Substance 3D Painter and flag versions at or below 11.0.2.
Alert on Substance 3D Painter process crashes recorded in Windows Application Event logs or macOS crash reports, which may indicate exploitation attempts.
Correlate file-open events for design applications with subsequent anomalous memory access or network egress patterns.

Monitoring Recommendations

Monitor email gateways and collaboration platforms for inbound Substance 3D project and asset files from untrusted senders.
Log process telemetry for Substance 3D Painter and baseline normal file access, memory, and network behavior.
Track version compliance through software asset management to confirm patched builds are deployed across creative workstations.

How to Mitigate CVE-2025-54189

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to the fixed release listed in Adobe Security Advisory APSB25-77.
Restrict opening of Substance 3D project and asset files to those originating from trusted internal sources or verified partners.
Educate creative and design teams about the risk of opening unsolicited project files, textures, or materials.

Patch Information

Adobe released the fix in security bulletin APSB25-77 on August 12, 2025. Administrators should upgrade all installations of Substance 3D Painter beyond version 11.0.2 using the Adobe Creative Cloud desktop application or through enterprise deployment tooling. Verify installed versions on all creative workstations after deployment.

Workarounds

If patching is not immediately possible, block execution of Substance 3D Painter through application control until the update is applied.
Isolate creative workstations that regularly handle third-party assets on segmented network zones with limited access to sensitive systems.
Scan inbound project files in a sandboxed environment before distributing them to end users.

bash

# Example: Windows inventory check for vulnerable Substance 3D Painter versions
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Painter*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate