CVE-2025-54198: Adobe Substance 3D Modeler Information Disclosure

CVE-2025-54198 Overview

CVE-2025-54198 is an out-of-bounds read vulnerability in Adobe Substance 3D Modeler versions 1.22.0 and earlier. The flaw allows an attacker to read memory outside the intended buffer boundary, potentially disclosing sensitive process memory. Exploitation requires a user to open a crafted malicious file in the Substance 3D Modeler application. The vulnerability is categorized under [CWE-125] Out-of-Bounds Read and affects local users who process untrusted 3D content.

Critical Impact
Successful exploitation may leak sensitive process memory contents, which attackers can use to bypass mitigations such as Address Space Layout Randomization (ASLR) or chain into further attacks.

Affected Products

Adobe Substance 3D Modeler 1.22.0
Adobe Substance 3D Modeler versions prior to 1.22.0
Windows and macOS installations of Substance 3D Modeler

Discovery Timeline

2025-08-12 - CVE-2025-54198 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54198

Vulnerability Analysis

The vulnerability resides in Adobe Substance 3D Modeler's file parsing logic. When the application processes a specially crafted 3D scene or asset file, it reads memory past the bounds of an allocated buffer. This out-of-bounds read exposes adjacent memory contents to the parsing routine, which the attacker can potentially observe through application state, error output, or subsequent processing.

The issue requires local access and user interaction, meaning a victim must be convinced to open the malicious file. Confidentiality is impacted, while integrity and availability remain intact based on the CVSS vector. See the Adobe Security Advisory APSB25-76 for vendor details.

Root Cause

The root cause is missing or insufficient bounds checking during the parsing of untrusted file data. The parser trusts length or offset values derived from the input file without validating them against the actual buffer size. This class of defect is tracked as [CWE-125] Out-of-Bounds Read.

Attack Vector

An attacker crafts a malicious Substance 3D Modeler project or asset file and delivers it through phishing, a compromised asset repository, or a shared collaboration workspace. When the victim opens the file, the parser triggers the out-of-bounds read. The disclosed memory may contain pointers, cryptographic material, or other sensitive artifacts useful for follow-on exploitation.

No verified proof-of-concept code is publicly available for this issue. See the Adobe Security Advisory APSB25-76 for further technical context.

Detection Methods for CVE-2025-54198

Indicators of Compromise

Substance 3D Modeler process crashes, hangs, or unexpected exceptions immediately after opening a project or asset file from an untrusted source.
Presence of Substance 3D Modeler asset files (for example, .sbs, .sbsar, or project files) delivered by email, chat, or external download from unverified senders.
Unusual child process activity or memory dumps produced by Substance 3D Modeler outside of normal workflow.

Detection Strategies

Monitor endpoints for Substance 3D Modeler executable crashes and Windows Error Reporting (WER) events referencing access violations.
Track file open events for Substance 3D Modeler sourced from browser downloads, email attachments, or removable media.
Alert on version telemetry showing Substance 3D Modeler installations at or below version 1.22.0 across managed endpoints.

Monitoring Recommendations

Maintain a software inventory to identify hosts running vulnerable Substance 3D Modeler builds.
Correlate file download telemetry with subsequent Substance 3D Modeler launches to flag suspicious open events.
Retain endpoint process and crash telemetry long enough to support retrospective investigation of memory disclosure indicators.

How to Mitigate CVE-2025-54198

Immediate Actions Required

Update Adobe Substance 3D Modeler to the fixed version identified in Adobe Security Advisory APSB25-76.
Instruct users not to open Substance 3D Modeler files received from untrusted or unverified sources.
Inventory all systems running Substance 3D Modeler 1.22.0 or earlier and prioritize patching for workstations handling external assets.

Patch Information

Adobe published Security Advisory APSB25-76 addressing CVE-2025-54198. Administrators should apply the vendor-supplied update to Substance 3D Modeler on all affected Windows and macOS endpoints. Verify that installed versions are above 1.22.0 after patch deployment.

Workarounds

Restrict Substance 3D Modeler usage to trusted asset repositories until patching is complete.
Open untrusted 3D content only inside isolated virtual machines or dedicated review workstations without access to sensitive data.
Enforce application allowlisting policies that block execution of Substance 3D Modeler on hosts that do not require it.

bash

# Example: query installed Substance 3D Modeler version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Modeler" /s | findstr /i version