CVE-2025-54203: Adobe Substance 3D Modeler Info Leak Flaw

CVE-2025-54203 Overview

CVE-2025-54203 affects Adobe Substance 3D Modeler versions 1.22.0 and earlier. The vulnerability is an out-of-bounds read [CWE-125] that can disclose sensitive memory contents to an attacker. Exploitation requires user interaction, specifically that a victim opens a malicious file crafted by the attacker. Adobe published guidance in security advisory APSB25-76. The flaw does not permit code execution or data modification on its own, but leaked memory can support secondary attacks such as bypassing address space layout randomization.

Critical Impact
An attacker who convinces a user to open a malicious project file can read process memory from Substance 3D Modeler and expose sensitive data.

Affected Products

Adobe Substance 3D Modeler 1.22.0
Adobe Substance 3D Modeler versions prior to 1.22.0
Windows and macOS installations of Substance 3D Modeler

Discovery Timeline

2025-08-12 - CVE-2025-54203 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54203

Vulnerability Analysis

The issue is an out-of-bounds read in Substance 3D Modeler's file parsing logic. When the application processes a crafted input file, it reads beyond the bounds of an allocated buffer. The read operation returns adjacent memory contents to the application, which can then be exposed through error messages, rendered output, or subsequent processing. Impact is limited to confidentiality; integrity and availability are not affected according to the vector data. The attack requires local access because the victim must open the malicious file within the desktop application.

Root Cause

Out-of-bounds read vulnerabilities [CWE-125] occur when parsing code fails to validate size or offset fields against actual buffer bounds. In file format parsers, this typically stems from trusting length fields, index values, or record counts embedded in the input. Adobe's advisory does not disclose the specific parser component or field responsible.

Attack Vector

An attacker crafts a malicious Substance 3D Modeler project or asset file and delivers it through email, chat, a shared drive, or a compromised asset marketplace. The victim opens the file in a vulnerable version of Substance 3D Modeler. During parsing, the application reads memory outside the intended buffer, and portions of that memory can be recovered by the attacker through side effects of the application's handling.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details beyond Adobe's advisory have not been released publicly.

Detection Methods for CVE-2025-54203

Indicators of Compromise

Substance 3D Modeler project files received from untrusted sources, particularly through email attachments or third-party asset marketplaces
Unexpected crashes or error dialogs from Modeler.exe after opening a project file
File format mismatches where extensions do not match internal file signatures for Substance 3D assets

Detection Strategies

Inventory endpoints running Adobe Substance 3D Modeler and identify installations at or below version 1.22.0
Alert on Substance 3D Modeler processes spawning unexpected child processes or accessing sensitive user directories after opening a file
Monitor for outbound network transfers from creative workstations that follow shortly after opening third-party asset files

Monitoring Recommendations

Enable file provenance tracking and mark of the web on downloaded design assets so opened files can be traced back to their source
Log process starts and file opens for Modeler.exe and correlate against the source URL or email of the opened file
Review endpoint telemetry for anomalous memory read patterns or crash dumps generated by Substance 3D Modeler

How to Mitigate CVE-2025-54203

Immediate Actions Required

Upgrade Adobe Substance 3D Modeler to the fixed version listed in Adobe Security Advisory APSB25-76
Restrict opening of Substance 3D Modeler files to those from trusted internal sources until patching is complete
Communicate the risk to 3D artists and design teams so they avoid opening unsolicited project files

Patch Information

Adobe addressed CVE-2025-54203 in the update described in Adobe Security Advisory APSB25-76. Administrators should apply the vendor-supplied update to all installations of Substance 3D Modeler 1.22.0 and earlier. Use Adobe Creative Cloud desktop or managed software deployment to push the update to workstations.

Workarounds

Block or quarantine Substance 3D Modeler file types received from external email senders at the mail gateway
Require creative teams to review file sources through a sandboxed workstation before opening on production systems
Remove Substance 3D Modeler from endpoints that do not have a business need for it until patching is confirmed

bash

# Example: audit installed Substance 3D Modeler versions on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Modeler*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation