CVE-2025-54201: Adobe Substance 3D Modeler Information Disclosure

CVE-2025-54201 Overview

CVE-2025-54201 is an out-of-bounds read vulnerability in Adobe Substance 3D Modeler versions 1.22.0 and earlier. The flaw resides in file parsing logic and can disclose sensitive process memory to an attacker. Exploitation requires user interaction, specifically the victim opening a crafted malicious file in the application. The issue is classified under CWE-125 and affects local users of the 3D modeling software. Adobe published details in Security Bulletin APSB25-76 and released a fixed build to address the defect.

Critical Impact
Attackers can read adjacent heap or stack memory, exposing sensitive data such as pointers, tokens, or file contents that may aid follow-on exploitation.

Affected Products

Adobe Substance 3D Modeler versions 1.22.0 and earlier
Windows installations of Substance 3D Modeler
macOS installations of Substance 3D Modeler

Discovery Timeline

2025-08-12 - CVE-2025-54201 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54201

Vulnerability Analysis

Substance 3D Modeler parses several proprietary and third-party 3D asset formats. The application reads bytes beyond the bounds of an allocated buffer while processing malformed file structures. This out-of-bounds read [CWE-125] returns memory contents that were never intended to be exposed to the parser's output path.

The attack is local and requires user interaction. A victim must open a malicious file supplied through email, download, or shared project assets. The disclosed memory may contain sensitive artifacts, including uninitialized heap data, address pointers useful for bypassing ASLR, or fragments of prior file content held in reused allocations.

Root Cause

The root cause is missing or insufficient bounds validation on length fields, offsets, or index calculations inside the file parser. When a crafted file supplies values that exceed the size of the underlying buffer, the parser dereferences memory outside the intended object. Adobe has not published the specific parser routine, but the CWE-125 classification confirms the read boundary failure.

Attack Vector

An attacker crafts a malicious 3D asset file and delivers it to a target user. When the user opens the file inside Substance 3D Modeler, the parser triggers the out-of-bounds read. The attacker does not gain code execution directly. Instead, the leaked memory can be exfiltrated through error messages, telemetry, or chained with a second vulnerability to escalate impact.

No public proof-of-concept exists at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-54201

Indicators of Compromise

Unexpected crashes or hangs of Adobe Substance 3D Modeler.exe when opening third-party project files
Substance 3D Modeler process reading files from untrusted directories such as Downloads or email attachment cache paths
Anomalous outbound network activity from the Substance 3D Modeler process shortly after opening a new asset

Detection Strategies

Monitor endpoint telemetry for Substance 3D Modeler process crashes correlated with file open operations
Inspect email and web gateway logs for delivery of uncommon 3D asset file extensions to design or content-creation staff
Alert on Substance 3D Modeler spawning child processes or writing to sensitive user directories after opening an asset

Monitoring Recommendations

Track installed versions of Substance 3D Modeler across managed endpoints and flag any build at or below 1.22.0
Log file-open events for the Modeler process and retain the source path for forensic review
Enable crash dump collection on creative workstations to identify parser faults consistent with out-of-bounds reads

How to Mitigate CVE-2025-54201

Immediate Actions Required

Upgrade Substance 3D Modeler to the fixed version specified in Adobe Security Bulletin APSB25-76
Instruct users to open only trusted 3D asset files and to validate the sender before opening attachments
Inventory all workstations running Substance 3D Modeler and prioritize creative and design teams for patching

Patch Information

Adobe released a security update for Substance 3D Modeler that addresses CVE-2025-54201. Administrators should refer to Adobe Security Bulletin APSB25-76 for the exact fixed version and download links. Apply the update through the Adobe Creative Cloud desktop client or the enterprise deployment tools used in your environment.

Workarounds

Restrict Substance 3D Modeler use to files originating from trusted internal repositories until patching completes
Apply application allow-listing to prevent unpatched Modeler builds from launching on managed endpoints
Use email and web filtering rules to quarantine uncommon 3D asset file types from external senders

bash

# Query installed Substance 3D Modeler version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Modeler" /v Version

# macOS version check
defaults read "/Applications/Adobe Substance 3D Modeler.app/Contents/Info.plist" CFBundleShortVersionString