CVE-2025-54192: Adobe Substance 3D Painter Disclosure Flaw

CVE-2025-54192 Overview

CVE-2025-54192 affects Adobe Substance 3D Painter versions 11.0.2 and earlier. The vulnerability is an out-of-bounds read [CWE-125] that can disclose sensitive process memory when a user opens a malicious file. Exploitation requires local access and user interaction, since a victim must open a specially crafted file in the affected application. Adobe published Security Advisory APSB25-77 describing the flaw and providing remediation guidance.

Critical Impact
An attacker can read data outside the intended memory bounds of Substance 3D Painter, exposing sensitive information from the process address space to support follow-on attacks such as bypassing memory protections.

Affected Products

Adobe Substance 3D Painter 11.0.2
Adobe Substance 3D Painter prior versions (all releases up to and including 11.0.2)
Windows and macOS installations of the affected versions

Discovery Timeline

2025-08-12 - CVE-2025-54192 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-54192

Vulnerability Analysis

CVE-2025-54192 is an out-of-bounds read in Adobe Substance 3D Painter, a 3D texturing and material authoring application. The flaw is classified under [CWE-125: Out-of-bounds Read]. Substance 3D Painter parses a range of proprietary and third-party file formats, including project files, mesh files, and texture assets. When a crafted file is opened, the parser reads memory beyond an allocated buffer, returning bytes that were never intended to leave the process.

The disclosed memory may contain pointers, heap metadata, application secrets, or fragments of other loaded assets. Attackers commonly chain out-of-bounds read primitives with other vulnerabilities to defeat Address Space Layout Randomization (ASLR) and enable reliable code execution. The issue does not modify memory or crash the application by itself, so exploitation can be silent from the user's perspective.

Root Cause

The root cause is missing or incorrect bounds validation during file parsing. A length, offset, or index field taken from an attacker-controlled file is not checked against the actual size of the destination buffer or backing structure. The reader then dereferences memory past the valid region.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious project or asset file through email, chat, a compromised asset marketplace, or a shared drive. The victim opens the file in Substance 3D Painter, triggering the vulnerable parser path. No elevated privileges are required, and the attacker only needs the victim to load the file. See the Adobe Security Advisory APSB25-77 for vendor guidance.

Detection Methods for CVE-2025-54192

Indicators of Compromise

Unexpected Substance 3D Painter processes opening files from user download directories, email attachments, or removable media
Anomalous child processes or network connections spawned shortly after Substance 3D Painter loads a project or asset file
Substance 3D Painter crashes or abnormal exits correlated with the receipt of untrusted .spp, .spsm, mesh, or texture files

Detection Strategies

Inventory endpoints running Adobe Substance 3D Painter and flag installations at or below version 11.0.2 for remediation
Alert when Substance 3D Painter reads files originating from untrusted sources such as browser download folders or email client cache paths
Correlate file-open events for Substance 3D Painter with process telemetry to identify parsing crashes or unusual memory access patterns

Monitoring Recommendations

Collect endpoint process, file, and module-load telemetry for Substance 3D Painter to support forensic reconstruction if a malicious file is opened
Monitor egress traffic from workstations used for 3D content creation for beaconing or data staging that follows file-open events
Review application crash reports and Windows Error Reporting or macOS crash logs for repeated faults in Substance 3D Painter parsing modules

How to Mitigate CVE-2025-54192

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to the fixed version identified in Adobe Security Advisory APSB25-77
Instruct users to open only project and asset files received from trusted internal sources or verified marketplaces
Prioritize patching on workstations that regularly consume externally sourced 3D content

Patch Information

Adobe addressed CVE-2025-54192 in the security update published in Adobe Security Advisory APSB25-77. Administrators should apply the vendor-supplied update to all Substance 3D Painter installations at version 11.0.2 or earlier. Verify the installed build after upgrade and remove any legacy versions from managed endpoints.

Workarounds

Restrict Substance 3D Painter to opening files from a controlled, allow-listed directory managed by IT
Sandbox the application with operating system controls such as Windows AppContainer or macOS App Sandbox where feasible
Block delivery of Substance 3D Painter project and asset file types through email gateways when senders are not on an approved list

bash

# Configuration example
# Windows: query installed Substance 3D Painter version to identify vulnerable hosts
reg query "HKLM\SOFTWARE\Adobe\Adobe Substance 3D Painter" /s | findstr /I "Version"

# macOS: check installed version from the application bundle
defaults read "/Applications/Adobe Substance 3D Painter.app/Contents/Info.plist" CFBundleShortVersionString