CVE-2025-54235: Adobe Substance 3D Modeler Information Disclosure

CVE-2025-54235 Overview

Adobe Substance 3D Modeler versions 1.22.0 and earlier contain an out-of-bounds read vulnerability [CWE-125] that can disclose sensitive process memory. An attacker must convince a victim to open a crafted project file to trigger the flaw. The issue affects local workflows and does not grant code execution or write access to memory on its own. Adobe addressed the vulnerability in security bulletin APSB25-76.

Critical Impact
Successful exploitation leaks memory contents from the Substance 3D Modeler process, potentially exposing data useful for chaining with other vulnerabilities.

Affected Products

Adobe Substance 3D Modeler 1.22.0
Adobe Substance 3D Modeler earlier than 1.22.0
All supported platforms running the affected Modeler builds

Discovery Timeline

2025-08-12 - CVE-2025-54235 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54235

Vulnerability Analysis

The flaw is an out-of-bounds read within Adobe Substance 3D Modeler's file parsing logic. When the application loads a malformed scene or asset file, it reads memory beyond the bounds of an allocated buffer. The resulting data can be returned to attacker-controlled fields in the file format or reflected through error paths, enabling disclosure of adjacent memory. Confidentiality is the only directly affected security property; the vulnerability does not corrupt memory or alter execution flow.

Exploitation requires user interaction. A victim must open a malicious .sbsm or related Modeler project file supplied through email, chat, or a shared asset repository.

Root Cause

The vulnerability stems from missing or insufficient bounds validation during deserialization of a structure in the file parser. The parser trusts a length or offset value from the input file and dereferences memory without verifying it against the allocated buffer size. This is a classic [CWE-125] Out-of-Bounds Read pattern in native binary file format handlers.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a Modeler project file containing a manipulated size or index field. The attacker then delivers the file through standard distribution channels such as asset marketplaces, email attachments, or collaboration platforms. Opening the file in a vulnerable Modeler build triggers the read, and leaked memory may be exfiltrated through subsequent file saves or network callbacks.

See the Adobe Security Bulletin APSB25-76 for vendor technical details.

Detection Methods for CVE-2025-54235

Indicators of Compromise

Unexpected crashes or memory access faults in Adobe Substance 3D Modeler.exe shortly after opening a project file
Modeler project files received from untrusted sources with abnormally small or malformed headers
Modeler processes initiating unexpected outbound network connections after loading a new asset

Detection Strategies

Monitor endpoint telemetry for Substance 3D Modeler process crashes correlated with newly opened files
Flag Modeler project files delivered through email gateways or chat platforms from external senders
Alert on child process creation or anomalous file write activity originating from the Modeler process

Monitoring Recommendations

Inventory installed Substance 3D Modeler versions across creative workstations and flag any build at or below 1.22.0
Capture process execution and file open events from endpoint detection tooling to support retrospective hunts
Track Adobe security bulletin feeds to accelerate response when related Modeler advisories are published

How to Mitigate CVE-2025-54235

Immediate Actions Required

Upgrade Adobe Substance 3D Modeler to the fixed release identified in Adobe Security Bulletin APSB25-76
Instruct users to open Modeler project files only from trusted sources until patching is complete
Review shared asset libraries for files received from external contributors during the exposure window

Patch Information

Adobe published the fix in Adobe Security Bulletin APSB25-76. Administrators should deploy the updated Modeler build through the Adobe Creative Cloud desktop application or managed enterprise deployment tooling.

Workarounds

Restrict Modeler project file ingestion to vetted internal repositories while patching is in progress
Use application allowlisting to prevent unapproved Modeler builds from executing on managed endpoints
Isolate creative workstations handling third-party assets on segmented network zones to limit exfiltration paths

bash

# Configuration example
# Query installed Substance 3D Modeler version on Windows endpoints
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Modeler" /v Version