CVE-2025-54193: Adobe Substance 3D Painter Information Disclosure

CVE-2025-54193 Overview

CVE-2025-54193 is an out-of-bounds read vulnerability in Adobe Substance 3D Painter versions 11.0.2 and earlier. The flaw allows an attacker to read memory outside the bounds of an allocated buffer, which can disclose sensitive process memory. Exploitation requires user interaction: a victim must open a malicious file crafted by the attacker. The vulnerability is tracked under CWE-125: Out-of-bounds Read and affects local attack scenarios only. Adobe addressed the issue in security bulletin APSB25-77.

Critical Impact
Successful exploitation discloses sensitive memory contents from the Substance 3D Painter process, which may include address space layout data useful for chaining further attacks.

Affected Products

Adobe Substance 3D Painter 11.0.2
Adobe Substance 3D Painter versions prior to 11.0.2
Windows and macOS installations of Substance 3D Painter

Discovery Timeline

2025-08-12 - CVE-2025-54193 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54193

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] triggered when Substance 3D Painter parses a malformed project or asset file. The application reads beyond the intended boundaries of a buffer, returning adjacent memory contents to the parser or renderer. Those contents can include pointers, texture data, or other process state that should not be accessible to file inputs. Because the read operates on attacker-controlled offsets or lengths, the exposed data varies by file structure. The flaw affects confidentiality but does not directly corrupt memory or alter program flow.

Root Cause

The root cause is missing or insufficient bounds validation during parsing of a specific file format handled by Substance 3D Painter. The parser trusts a length or offset value sourced from the input file without verifying it against the actual allocation size. Adobe has not published the specific file format or code path affected in the public advisory.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious Substance 3D Painter project, texture, or asset file and delivers it through email, a shared repository, or a marketplace download. When the victim opens the file in a vulnerable version of Substance 3D Painter, the parser performs the out-of-bounds read. The leaked memory can be exfiltrated through saved project output, exported assets, or rendered content that reflects the disclosed bytes. No network access or elevated privileges are required.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-54193

Indicators of Compromise

Substance 3D Painter process crashes or unexpected exceptions when opening third-party project files
Unusual file-open telemetry originating from untrusted locations (email attachments, downloads, shared drives) targeting .spp, .sbsar, or related asset files
Export or render artifacts containing byte patterns inconsistent with the expected scene content

Detection Strategies

Inventory endpoints running Substance 3D Painter and flag installations at or below version 11.0.2
Alert on execution of Substance 3D Painter.exe when launched with file arguments sourced from internet-downloaded directories
Correlate crash dumps from the Substance 3D Painter process with recent file-open events to identify potential exploitation attempts

Monitoring Recommendations

Collect endpoint process and file telemetry for creative-workstation users who handle externally sourced 3D assets
Monitor for anomalous outbound transfers of exported assets following the opening of untrusted project files
Track application version drift to confirm patch deployment across design teams

How to Mitigate CVE-2025-54193

Immediate Actions Required

Update Adobe Substance 3D Painter to the version specified in Adobe Security Advisory APSB25-77
Instruct users not to open Substance 3D Painter project or asset files received from untrusted sources until the patch is applied
Audit creative workstations to identify installations at version 11.0.2 or earlier

Patch Information

Adobe released the fix in security bulletin APSB25-77. Administrators should apply the patched build of Substance 3D Painter through the Adobe Creative Cloud desktop application or the enterprise deployment channel. Refer to the vendor advisory for the exact fixed version and platform coverage.

Workarounds

Restrict Substance 3D Painter use to files originating from trusted internal repositories until patches are deployed
Run Substance 3D Painter under a standard user account to limit the blast radius of any memory disclosure
Isolate creative workstations handling externally supplied assets on segmented network zones

bash

# Verify installed Substance 3D Painter version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Painter" /v Version

# Verify installed version on macOS
defaults read "/Applications/Adobe Substance 3D Painter/Adobe Substance 3D Painter.app/Contents/Info.plist" CFBundleShortVersionString