CVE-2025-54197: Adobe Substance 3D Modeler Memory Disclosure

CVE-2025-54197 Overview

Adobe Substance 3D Modeler versions 1.22.0 and earlier contain an out-of-bounds read vulnerability [CWE-125] that can disclose sensitive process memory. An attacker crafts a malicious project file and delivers it to a victim through email, chat, or a compromised web page. When the victim opens the file in Substance 3D Modeler, the application reads memory beyond an allocated buffer and exposes its contents. Exploitation requires local user interaction and does not affect integrity or availability. Adobe assigned the issue in advisory APSB25-76 and released a patched build to address the flaw.

Critical Impact
Successful exploitation leaks process memory that may contain sensitive artifacts such as pointers, project data, or credentials cached by the application.

Affected Products

Adobe Substance 3D Modeler 1.22.0
Adobe Substance 3D Modeler earlier than 1.22.0
Windows and macOS builds distributed via Adobe Creative Cloud

Discovery Timeline

2025-08-12 - CVE-2025-54197 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54197

Vulnerability Analysis

Substance 3D Modeler parses proprietary 3D scene and asset files during project load. The vulnerability occurs when the parser reads structured fields whose declared length exceeds the allocated buffer boundary. The application dereferences memory addresses outside the intended object, returning uninitialized or adjacent heap data to internal handlers.

The out-of-bounds read does not corrupt memory or execute attacker code directly. Instead, it exposes fragments of the process address space that may include heap metadata, ASLR-defeating pointers, or residual data from prior operations. Attackers can pair the leak with a separate memory-corruption bug to bypass mitigations and stage code execution.

Adobe categorized the flaw as important in advisory APSB25-76 and shipped a corrected parser routine in the current release channel.

Root Cause

The root cause is missing bounds validation on a length or offset field within the file-parsing logic. The parser trusts attacker-controlled metadata and performs a read beyond the end of the allocated buffer, matching the [CWE-125] Out-of-Bounds Read classification.

Attack Vector

Exploitation is local and requires user interaction. The attacker distributes a malicious Substance 3D Modeler project or asset file and convinces a user to open it. On file open, the vulnerable parser triggers the out-of-bounds read and surfaces leaked bytes through subsequent processing paths or error output.

No authentication is required on the target system, and no privileges are needed beyond running the desktop application. See the Adobe Security Bulletin APSB25-76 for vendor technical guidance.

Detection Methods for CVE-2025-54197

Indicators of Compromise

Unexpected Substance 3D Modeler crashes or exception logs immediately after opening a third-party project file
Substance 3D Modeler processes reading unusually large or malformed asset files from Downloads, email attachment directories, or removable media
Outbound network connections from Modeler.exe shortly after opening an untrusted asset

Detection Strategies

Alert on execution of Substance 3D Modeler versions at or below 1.22.0 across managed workstations
Correlate file-open telemetry with process crashes to identify parser exceptions triggered by malicious assets
Inspect email and web gateway telemetry for delivery of Substance 3D project files (.sbsar, .sbs, and Modeler-specific formats) from untrusted senders

Monitoring Recommendations

Track application version inventory for Adobe Substance 3D Modeler and flag hosts running vulnerable builds
Monitor endpoint logs for repeated abnormal terminations of Modeler.exe that may indicate exploitation attempts
Retain file-write and file-open events for creative workstations to support incident reconstruction after a suspected leak

How to Mitigate CVE-2025-54197

Immediate Actions Required

Update Substance 3D Modeler to the version listed in Adobe advisory APSB25-76 through Adobe Creative Cloud
Instruct users to open only project files received from trusted collaborators and verified sources
Quarantine any Substance 3D Modeler asset files received from unknown senders pending review

Patch Information

Adobe released a fixed build addressing CVE-2025-54197. Deploy the update through Adobe Creative Cloud Desktop or enterprise packaging tools. Refer to the Adobe Security Bulletin APSB25-76 for the exact fixed version and download links.

Workarounds

Restrict Substance 3D Modeler usage to trusted project files until the patch is applied
Apply application allowlisting to prevent execution of vulnerable Modeler builds on managed endpoints
Enforce least-privilege user accounts on creative workstations to limit the value of any leaked memory

bash

# Configuration example
# Verify installed Substance 3D Modeler version on Windows
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Modeler*" } |
  Select-Object DisplayName, DisplayVersion