CVE-2025-54222: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-54222 Overview

CVE-2025-54222 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Substance 3D Stager versions 3.1.3 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Adobe published the issue on August 12, 2025, and addressed it in security bulletin APSB25-81.

The vulnerability requires local access and user interaction, limiting its use to social engineering and supply-chain delivery scenarios. Attackers can craft malicious 3D project files that trigger memory corruption when parsed by the application. Successful exploitation yields code execution at the privilege level of the user running Substance 3D Stager.

Critical Impact
Successful exploitation enables arbitrary code execution on Windows and macOS systems running vulnerable versions of Adobe Substance 3D Stager.

Affected Products

Adobe Substance 3D Stager 3.1.3 and earlier
Microsoft Windows installations of Substance 3D Stager
Apple macOS installations of Substance 3D Stager

Discovery Timeline

2025-08-12 - CVE-2025-54222 published to NVD
2025-08-12 - Adobe releases security bulletin APSB25-81
2025-08-14 - Last updated in NVD database

Technical Details for CVE-2025-54222

Vulnerability Analysis

The issue is classified as an out-of-bounds write [CWE-787], a memory corruption class where the application writes data past the boundary of an allocated buffer. In Substance 3D Stager, the unsafe write occurs while parsing untrusted file content used by the 3D staging workflow.

Writing beyond an allocated buffer can overwrite adjacent heap or stack metadata, function pointers, or object vtables. Attackers leverage this primitive to redirect control flow into attacker-controlled data. Because the application runs in user context, code executed via this flaw inherits the user's privileges, file access, and network reach.

The EPSS probability is 0.043% with a percentile of 13.4, indicating low observed interest in active exploitation at this time. No public proof-of-concept or in-the-wild exploitation has been reported by CISA KEV.

Root Cause

The root cause is missing or incorrect bounds validation when Substance 3D Stager processes structured data within an asset file. Length or index values derived from the file are used to compute write offsets without verifying that the destination remains within the allocated buffer.

Attack Vector

The attack vector is local with required user interaction. An attacker delivers a crafted Substance 3D Stager project or asset file through email, file sharing, or a compromised content repository. The vulnerability triggers when the victim opens the file in a vulnerable version of the application, leading to arbitrary code execution under the current user account.

No verified proof-of-concept code is publicly available. See the Adobe Security Bulletin APSB25-81 for vendor-supplied technical details.

Detection Methods for CVE-2025-54222

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe such as cmd.exe, powershell.exe, or bash.
Crashes or abnormal termination of Substance 3D Stager shortly after opening a third-party asset or project file.
Substance 3D Stager writing executable content or scripts to user-writable directories like %TEMP%, %APPDATA%, or ~/Library/Application Support.
Outbound network connections from the Substance 3D Stager process to untrusted hosts after opening a file.

Detection Strategies

Hunt for process lineage anomalies where Substance 3D Stager is the parent of interpreters, shells, or LOLBins.
Alert on installed Substance 3D Stager versions at or below 3.1.3 reported by endpoint inventory.
Inspect recently opened 3D asset files with unusual sizes, malformed headers, or origins outside trusted repositories.

Monitoring Recommendations

Enable Endpoint Detection and Response (EDR) telemetry for process creation, file write, and module load events from the Substance 3D Stager binary.
Forward application crash events from Windows Event Log and macOS unified logs to a central SIEM for review.
Track file-open activity for Substance 3D Stager users in environments handling third-party 3D content.

How to Mitigate CVE-2025-54222

Immediate Actions Required

Upgrade Adobe Substance 3D Stager to the fixed version listed in Adobe Security Bulletin APSB25-81.
Inventory all Windows and macOS endpoints running Substance 3D Stager 3.1.3 or earlier and prioritize them for patching.
Instruct users to open Substance 3D project files only from trusted sources until patching completes.

Patch Information

Adobe released a patched version of Substance 3D Stager addressing CVE-2025-54222 alongside the publication of bulletin APSB25-81 on August 12, 2025. Apply the update through Adobe Creative Cloud Desktop or the standalone installer published on the vendor advisory page.

Workarounds

Restrict execution of Substance 3D Stager to users with a clear business need until the patch is applied.
Block delivery of untrusted 3D asset files through email gateways and managed file transfer policies.
Run Substance 3D Stager under a standard, non-administrative user account to limit post-exploitation impact.

bash

# Example: query installed Substance 3D Stager version on Windows
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Substance 3D Stager"

# Example: query installed Substance 3D Stager version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Stager/Adobe Substance 3D Stager.app"