CVE-2025-54199: Adobe Substance 3D Modeler Disclosure Flaw

CVE-2025-54199 Overview

Adobe Substance 3D Modeler versions 1.22.0 and earlier contain an out-of-bounds read vulnerability [CWE-125] that can disclose sensitive memory contents. An attacker exploits the flaw by crafting a malicious project file and convincing a user to open it in the vulnerable application. Successful exploitation reveals process memory that may include pointers, cryptographic material, or other application data useful for chaining further attacks.

Critical Impact
Opening a crafted file in Adobe Substance 3D Modeler 1.22.0 or earlier discloses process memory contents to an attacker-controlled parser, enabling information leakage that can facilitate follow-on exploitation.

Affected Products

Adobe Substance 3D Modeler 1.22.0
All Adobe Substance 3D Modeler versions prior to 1.22.0
Windows and macOS builds of the affected releases

Discovery Timeline

2025-08-12 - CVE-2025-54199 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54199

Vulnerability Analysis

The issue is an out-of-bounds read within Adobe Substance 3D Modeler's file parsing logic. When the application processes a malformed input file, it reads past the intended bounds of an allocated buffer. The result is that adjacent memory is returned to the parser and can be surfaced to the attacker through the application's rendering, error handling, or serialization paths.

Because the attack vector is local and requires user interaction, exploitation depends on social engineering. A victim must open a malicious 3D model or project file received through email, chat, a shared drive, or a compromised asset repository. No elevated privileges are required to trigger the flaw.

Information disclosure vulnerabilities of this class are frequently paired with memory corruption bugs. Leaked pointers defeat Address Space Layout Randomization (ASLR), providing an attacker the base addresses needed to build reliable exploits against a co-existing write primitive.

Root Cause

The root cause is missing or incorrect boundary validation during deserialization of untrusted file content. The parser trusts a length or index field supplied by the input file and issues a read against a buffer without confirming that the offset stays within the allocated region. Adobe classifies this behavior under CWE-125: Out-of-bounds Read.

Attack Vector

Exploitation requires local delivery of a crafted file and user interaction to open it. An attacker distributes a weaponized .sbsar, .sbs, or related Substance 3D project file. When the target opens the file, the vulnerable parser executes and returns out-of-bounds memory to attacker-observable channels. There is no network-based remote trigger.

The vulnerability affects confidentiality only; integrity and availability are not directly impacted according to the CVSS vector.

Detection Methods for CVE-2025-54199

Indicators of Compromise

Unexpected Substance 3D Modeler crashes or hangs shortly after opening third-party project files
Substance 3D Modeler processes reading files from user download directories, email attachment cache paths, or removable media
Substance 3D project files sourced from untrusted asset marketplaces or unsolicited email attachments

Detection Strategies

Inventory endpoints running Adobe Substance 3D Modeler and flag any installation at version 1.22.0 or earlier
Monitor process telemetry for Adobe Substance 3D Modeler.exe opening files with anomalous sizes or malformed headers
Correlate file-open events with subsequent process crashes to identify probing or exploitation attempts

Monitoring Recommendations

Collect endpoint process and file activity into a central data lake for retroactive hunting against the affected binary
Alert on Substance 3D Modeler child processes or unusual outbound network connections following file opens
Track version drift across creative workstations to confirm patch adoption after remediation

How to Mitigate CVE-2025-54199

Immediate Actions Required

Update Adobe Substance 3D Modeler to the fixed release identified in Adobe Security Advisory APSB25-76
Restrict opening of Substance 3D project files to those originating from trusted internal sources or verified vendors
Educate 3D artists and modelers about the risk of opening unsolicited project files

Patch Information

Adobe published the fix in security bulletin APSB25-76. Administrators should deploy the vendor-supplied update to all systems running Substance 3D Modeler 1.22.0 or earlier. Verify successful installation by checking the application's version string after upgrade.

Workarounds

Remove or disable Adobe Substance 3D Modeler on endpoints where the application is not required until patching is complete
Use application allowlisting to prevent Substance 3D Modeler from opening files delivered from email, chat, or web download paths
Scan incoming Substance 3D project files in a sandboxed environment before distributing them to production workstations

bash

# Windows: query the installed version of Substance 3D Modeler
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Modeler*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation