CVE-2025-54190: Adobe Substance 3D Painter Disclosure Flaw

CVE-2025-54190 Overview

CVE-2025-54190 is an out-of-bounds read vulnerability in Adobe Substance 3D Painter versions 11.0.2 and earlier. The flaw allows disclosure of sensitive process memory when a victim opens a maliciously crafted file. Exploitation requires local user interaction, limiting the attack surface to social engineering scenarios where an attacker convinces a target to open a weaponized project or asset file.

Adobe published fix guidance in security advisory APSB25-77. The vulnerability is categorized under CWE-125 (Out-of-bounds Read) and does not affect integrity or availability of the host system.

Critical Impact
An attacker can leak sensitive memory contents from the Substance 3D Painter process, potentially exposing data useful for chaining with additional exploits.

Affected Products

Adobe Substance 3D Painter version 11.0.2
Adobe Substance 3D Painter versions prior to 11.0.2
Windows and macOS installations of the affected releases

Discovery Timeline

2025-08-12 - CVE-2025-54190 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54190

Vulnerability Analysis

The vulnerability resides in file-parsing logic within Substance 3D Painter. When the application processes a specially crafted input file, it reads memory beyond the bounds of an allocated buffer. The out-of-bounds read exposes adjacent memory content to attacker-controlled parsing paths, which can then be echoed back or serialized into application state.

Because the attack vector is local and requires user interaction, exploitation depends on delivering the malicious file to the victim through channels such as email attachments, shared project repositories, or marketplace assets. The impact is limited to confidentiality; no code execution or process compromise is described in the vendor advisory.

Successful exploitation could reveal pointers, cryptographic material, or in-memory tokens that assist attackers in bypassing address space layout randomization (ASLR) or staging follow-on attacks against the same host.

Root Cause

The root cause is missing or insufficient boundary validation during parsing of a file format handled by Substance 3D Painter. Adobe has not published a detailed technical write-up. The Adobe Security Advisory APSB25-77 confirms the classification as an out-of-bounds read.

Attack Vector

Exploitation requires an attacker to craft a malicious asset or project file and deliver it to a Substance 3D Painter user. When the victim opens the file, the parser reads outside the intended buffer boundary and leaks memory contents. No network access, elevated privileges, or authentication is required beyond the user opening the file locally.

No public proof-of-concept or exploit code is available at the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-54190

Indicators of Compromise

Unexpected Substance 3D Painter crashes or anomalous memory usage when opening third-party project files
Presence of untrusted .spp, .spt, or related Substance asset files sourced from external email or download channels
Substance 3D Painter processes writing unusual diagnostic or dump files shortly after opening an asset

Detection Strategies

Inventory endpoints running Adobe Substance 3D Painter and flag installations at version 11.0.2 or earlier
Alert on Substance 3D Painter processes spawning child processes or accessing network endpoints outside normal telemetry patterns
Correlate file-open events for Substance 3D Painter with recent downloads from untrusted origins

Monitoring Recommendations

Monitor endpoint telemetry for Adobe Painter.exe (Windows) or the equivalent macOS binary loading files from user-writable or temporary directories
Track application crash telemetry, since out-of-bounds reads frequently trigger access violations before successful exploitation
Audit file-sharing platforms and asset marketplaces used by design teams for untrusted Substance content

How to Mitigate CVE-2025-54190

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to the version specified in Adobe Security Advisory APSB25-77
Restrict Substance 3D Painter users from opening project files received from untrusted sources
Educate design and content teams on the risk of opening asset files from unverified marketplaces or email attachments

Patch Information

Adobe addressed CVE-2025-54190 in the security update described in Adobe Security Advisory APSB25-77. Apply the vendor-recommended version through the Adobe Creative Cloud desktop application or enterprise deployment tooling.

Workarounds

Block or quarantine Substance 3D Painter asset files from external email and untrusted web downloads until patching completes
Run Substance 3D Painter under a standard user account to limit the value of any leaked in-process data
Isolate creative workstations that handle third-party assets on segmented network zones with restricted outbound access

bash

# Example: enumerate Substance 3D Painter versions across Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Painter*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation