CVE-2025-54191: Adobe Substance 3D Painter Disclosure Flaw

CVE-2025-54191 Overview

CVE-2025-54191 is an out-of-bounds read vulnerability in Adobe Substance 3D Painter versions 11.0.2 and earlier. The flaw allows an attacker to read memory outside the intended buffer boundaries, potentially disclosing sensitive process memory. Exploitation requires user interaction: a victim must open a malicious file crafted by the attacker. The issue is tracked as [CWE-125: Out-of-bounds Read] and was disclosed in Adobe security bulletin APSB25-77. The vulnerability affects local users only and does not directly enable code execution or data modification.

Critical Impact
Successful exploitation can expose sensitive memory contents from the Substance 3D Painter process, which may include artifacts useful for chaining with other vulnerabilities or leaking confidential project data.

Affected Products

Adobe Substance 3D Painter 11.0.2
Adobe Substance 3D Painter (all prior versions)
Windows and macOS installations of Substance 3D Painter

Discovery Timeline

2025-08-12 - CVE-2025-54191 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54191

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Adobe Substance 3D Painter's file parsing routines. When the application processes a specially crafted file, it reads data beyond the bounds of an allocated buffer. This behavior can expose adjacent memory contents to the attacker or to attacker-controlled logic within the file. The impact is limited to confidentiality: the CVSS vector indicates a high impact on confidentiality but no impact on integrity or availability. Exploitation is local and requires the victim to open the malicious asset in Substance 3D Painter.

Root Cause

Out-of-bounds read conditions typically stem from missing or incorrect boundary checks when parsing structured file formats. In this case, the Substance 3D Painter file parser trusts a length, offset, or index field from the input file without validating it against the actual buffer size. When the parser dereferences memory using this attacker-controlled value, it reads outside the allocated region and returns process memory that should not be accessible.

Attack Vector

The attack requires local access and user interaction. An attacker crafts a malicious Substance 3D Painter project or asset file and delivers it through email, a shared repository, an asset marketplace, or a supply-chain channel. When the target opens the file, the parser triggers the out-of-bounds read. Because the attack vector is local and privileges are not required, any user account running Substance 3D Painter is a viable target. Leaked memory can include heap metadata, pointers useful for defeating address space layout randomization, or fragments of unrelated project data. Refer to the Adobe Security Advisory APSB25-77 for vendor technical details.

Detection Methods for CVE-2025-54191

Indicators of Compromise

Unexpected Substance 3D Painter crashes or exceptions immediately after opening a project or asset file from an untrusted source.
Substance 3D Painter processes reading memory regions outside expected buffer allocations, visible in application crash dumps.
Delivery of .spp, .spt, or related Substance file formats from unknown senders, cloud shares, or third-party asset marketplaces.

Detection Strategies

Monitor endpoint telemetry for Adobe Substance 3D Painter.exe (Windows) or the macOS bundle executable spawning crash-reporter processes.
Alert on Substance 3D Painter opening files that were recently written by browser or email client processes, which indicates untrusted origin.
Correlate Substance 3D Painter process crashes with file open events using SIEM or endpoint detection tooling.

Monitoring Recommendations

Inventory all workstations with Substance 3D Painter installed and track installed versions against the fixed release.
Log file access events for Substance 3D Painter project directories to identify anomalous read patterns after opening untrusted assets.
Review Windows Error Reporting (WER) and macOS crash logs for repeated faults in Substance 3D Painter modules.

How to Mitigate CVE-2025-54191

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to the fixed version identified in Adobe bulletin APSB25-77 on all Windows and macOS endpoints.
Instruct users to open Substance 3D Painter files only from trusted sources such as internal project repositories or verified asset vendors.
Block or quarantine Substance file formats received through email gateways or unmanaged file-sharing platforms until patches are deployed.

Patch Information

Adobe published the fix in security bulletin APSB25-77. Administrators should download the updated Substance 3D Painter release from the Adobe Creative Cloud desktop application or the Adobe download portal. Full remediation details are available in the Adobe Security Advisory APSB25-77.

Workarounds

Restrict Substance 3D Painter usage to isolated workstations or virtual machines that do not hold sensitive credentials or artifacts.
Apply application allowlisting to prevent unpatched Substance 3D Painter versions from executing on managed endpoints.
Enforce mail and web content filtering rules that flag Substance file formats originating from external senders.

bash

# Verify installed Substance 3D Painter version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Painter" /v Version

# Verify installed version on macOS
defaults read "/Applications/Adobe Substance 3D Painter/Adobe Substance 3D Painter.app/Contents/Info.plist" CFBundleShortVersionString