CVE-2025-54204: Adobe Substance 3D Modeler Information Disclosure

CVE-2025-54204 Overview

CVE-2025-54204 is an out-of-bounds read vulnerability in Adobe Substance 3D Modeler versions 1.22.0 and earlier. The flaw, classified under [CWE-125], allows an attacker to read memory outside the intended buffer boundaries when the application parses a malicious file. Successful exploitation can disclose sensitive process memory, which may include pointers, application data, or other artifacts useful for further attack stages. Exploitation requires user interaction: a victim must open a crafted file with the affected application. Adobe published fix guidance in security advisory APSB25-76.

Critical Impact
An attacker can disclose sensitive memory from the Substance 3D Modeler process by convincing a user to open a malicious project or asset file.

Affected Products

Adobe Substance 3D Modeler 1.22.0
Adobe Substance 3D Modeler prior versions
Windows and macOS installations of Substance 3D Modeler

Discovery Timeline

2025-08-12 - CVE-2025-54204 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54204

Vulnerability Analysis

The vulnerability is an out-of-bounds read that occurs while Substance 3D Modeler processes attacker-controlled file content. When the parser reads beyond the bounds of an allocated buffer, adjacent process memory is returned to the calling code path. That memory can then be reflected into application state, logs, or exported artifacts, enabling disclosure to the attacker. The issue affects confidentiality only. It does not permit code execution, integrity modification, or denial of service based on the published CVSS vector.

Root Cause

The root cause is missing or incorrect bounds validation on a length or offset value taken from a parsed file structure. The parser trusts an attacker-controlled size, index, or offset and dereferences memory outside the intended buffer. This class of defect, tracked as [CWE-125], is common in binary file parsers that handle complex 3D asset formats with variable-length records.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious Substance 3D Modeler file and delivers it through phishing, a shared workspace, a supplier pipeline, or a compromised asset marketplace. The victim opens the file in a vulnerable version of Modeler, triggering the out-of-bounds read. No elevated privileges are required, and the attacker does not need prior access to the target system.

No public proof-of-concept exploit is available at the time of publication. See the Adobe Security Advisory APSB25-76 for vendor-provided technical details.

Detection Methods for CVE-2025-54204

Indicators of Compromise

Substance 3D Modeler project or asset files originating from untrusted email, chat, or web sources
Unexpected Modeler process crashes or abnormal termination shortly after opening a file
Modeler processes generating outbound network traffic or writing artifacts to unusual locations following file open events

Detection Strategies

Inventory endpoints running Substance 3D Modeler and flag installations at version 1.22.0 or earlier for prioritized remediation
Alert on execution of Substance 3D Modeler.exe (or the macOS binary) opening files from download, temporary, or email attachment directories
Correlate file-open events with subsequent process anomalies such as heap corruption crashes recorded in Windows Event Logs or macOS crash reports

Monitoring Recommendations

Collect endpoint process telemetry for Substance 3D Modeler and forward to a centralized data lake for retrospective analysis
Monitor email and collaboration platforms for inbound Substance 3D asset files, particularly from external senders
Track application version data through software asset management to confirm patch adoption across creative and design teams

How to Mitigate CVE-2025-54204

Immediate Actions Required

Upgrade Adobe Substance 3D Modeler to the fixed version identified in Adobe Security Advisory APSB25-76
Restrict opening of Substance 3D Modeler files received from untrusted or unverified sources until patching is complete
Communicate the risk to design, 3D art, and content production teams who routinely open external asset files

Patch Information

Adobe addressed CVE-2025-54204 in the update referenced by security bulletin APSB25-76. Administrators should deploy the patched Substance 3D Modeler build to all affected endpoints through the Adobe Creative Cloud desktop application or an enterprise software distribution system. Verify installed versions after deployment to confirm remediation.

Workarounds

Block or quarantine Substance 3D Modeler file types at email and web gateways when they originate from untrusted senders
Isolate 3D content workflows on dedicated workstations with limited access to sensitive data until updates are applied
Enforce least privilege on user accounts running Substance 3D Modeler to reduce the value of any memory disclosed by the process

bash

# Configuration example: identify vulnerable installations on Windows endpoints
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Modeler*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation