CVE-2025-54195 Overview
CVE-2025-54195 is an out-of-bounds read vulnerability affecting Adobe Substance 3D Painter versions 11.0.2 and earlier. The flaw is classified under [CWE-125] and can lead to disclosure of sensitive process memory when a victim opens a malicious file. Exploitation requires user interaction and local access, limiting scope but still exposing confidential in-memory data such as pointers, session artifacts, or file contents to an attacker who crafts a weaponized project or asset file.
Critical Impact
An attacker who convinces a user to open a crafted file can read memory outside allocated bounds, potentially disclosing sensitive information from the Substance 3D Painter process.
Affected Products
- Adobe Substance 3D Painter 11.0.2
- Adobe Substance 3D Painter versions prior to 11.0.2
- All supported platforms running vulnerable Substance 3D Painter builds
Discovery Timeline
- 2025-08-12 - CVE-2025-54195 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
- Vendor Advisory - Adobe Security Advisory APSB25-77
Technical Details for CVE-2025-54195
Vulnerability Analysis
The vulnerability is an out-of-bounds read in Adobe Substance 3D Painter's file parsing logic. When the application processes a malformed asset or project file, it reads memory outside the intended buffer bounds. The attacker cannot modify memory or execute code directly through this flaw, but the process can leak adjacent memory contents back to attacker-controlled data structures rendered or logged by the application. Because Substance 3D Painter routinely opens third-party textures, materials, and project archives, the attack surface for malicious file delivery is broad.
Root Cause
The defect stems from insufficient bounds validation on data fields parsed from user-supplied files, consistent with [CWE-125] Out-of-Bounds Read. A length or offset value embedded in the file is trusted without verification against the actual size of the allocated buffer, causing the parser to read past the end of the target region.
Attack Vector
Exploitation is local and requires user interaction: a victim must open a malicious file in Substance 3D Painter. The attacker has no privileges on the target system and does not need network access. Typical delivery paths include phishing emails with 3D asset attachments, malicious downloads from asset marketplaces, or shared project files distributed within collaborative workflows.
No public proof-of-concept code is available for this issue. Refer to the Adobe Security Advisory APSB25-77 for authoritative technical guidance.
Detection Methods for CVE-2025-54195
Indicators of Compromise
- Unexpected crashes or memory access violations in the Substance 3D Painter process shortly after opening a file
- Substance 3D Painter opening files from untrusted email attachments, download folders, or removable media
- Anomalous child processes or network connections initiated by the Substance 3D Painter process
Detection Strategies
- Inventory endpoints running Adobe Substance 3D Painter and flag installations at or below version 11.0.2
- Correlate process telemetry to identify Substance 3D Painter opening files with non-standard extensions or from suspicious paths
- Monitor endpoint EDR telemetry for read access violations or exception events originating from the Painter process
Monitoring Recommendations
- Enable file-open auditing for creative workstations and forward events to your SIEM or data lake
- Alert on Substance 3D Painter loading files delivered by email gateways or downloaded from unvetted marketplaces
- Track version telemetry continuously to confirm patch adoption across affected endpoints
How to Mitigate CVE-2025-54195
Immediate Actions Required
- Upgrade Adobe Substance 3D Painter to a version later than 11.0.2 as directed by Adobe Security Advisory APSB25-77
- Instruct users to open only trusted project and asset files until patching is complete
- Restrict Substance 3D Painter execution on high-value workstations pending patch validation
Patch Information
Adobe published Security Advisory APSB25-77 addressing CVE-2025-54195. Apply the vendor-supplied update through the Adobe Creative Cloud desktop client or through your managed software distribution platform. Confirm the installed build post-deployment to ensure the vulnerable version has been replaced.
Workarounds
- Block inbound email attachments containing Substance 3D Painter project or asset file types at the mail gateway
- Sandbox or restrict opening of third-party 3D assets on unpatched systems
- Apply application allowlisting to prevent Substance 3D Painter from launching from user-writable directories
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
