CVE-2025-54237: Adobe Substance 3D Stager Memory Disclosure

CVE-2025-54237 Overview

Adobe Substance 3D Stager versions 3.1.3 and earlier contain an out-of-bounds read vulnerability tracked as CVE-2025-54237. The flaw resides in file parsing logic and can expose contents of adjacent process memory. An attacker who convinces a user to open a crafted file can read data beyond the intended buffer boundary. Successful exploitation discloses sensitive information from the Substance 3D Stager process. The vulnerability affects installations on both Microsoft Windows and Apple macOS. Adobe addressed the issue in security bulletin APSB25-81.

Critical Impact
Local attackers can trigger memory disclosure through a malicious file, potentially leaking sensitive data such as pointers, session artifacts, or content from other loaded scenes.

Affected Products

Adobe Substance 3D Stager 3.1.3 and earlier
Microsoft Windows installations of Substance 3D Stager
Apple macOS installations of Substance 3D Stager

Discovery Timeline

2025-09-16 - CVE-2025-54237 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54237

Vulnerability Analysis

CVE-2025-54237 is an out-of-bounds read classified under [CWE-125]. The issue occurs when Substance 3D Stager parses a specially crafted asset or project file. The parser reads memory outside the allocated buffer, returning uninitialized or adjacent heap contents to the caller. The disclosed data can include function pointers, ASLR-relevant addresses, or fragments of previously processed scene data. Exploitation is local and requires user interaction, as the victim must open the malicious file. The condition does not permit code execution or data modification on its own, but the leaked memory can serve as a building block for bypassing address space layout randomization in a chained attack.

Root Cause

The root cause is missing or insufficient bounds validation during deserialization of a 3D scene or asset structure. The application trusts a size or offset value embedded in the input file without verifying that the derived read stays within the allocated buffer. As a result, subsequent read operations reference memory beyond the object boundary.

Attack Vector

Exploitation requires an attacker to deliver a malicious .stager, .sbsar, or related asset file through phishing, a compromised project share, or a supply-chain-tainted asset library. When the victim opens the file in Substance 3D Stager, the parser triggers the out-of-bounds read. Leaked memory can be exfiltrated if the application renders, logs, or transmits the affected structure. Because the attack vector is local and no privileges are required beyond the invoking user, unprivileged 3D artists and design staff are the primary targets.

No verified public proof-of-concept exists at this time. See the Adobe Security Update APSB25-81 for vendor technical details.

Detection Methods for CVE-2025-54237

Indicators of Compromise

Unexpected Stager.exe or Adobe Substance 3D Stager process crashes shortly after opening third-party asset files.
Substance 3D Stager project or asset files arriving from untrusted email, chat, or file-sharing sources.
Anomalous outbound network activity from the Stager process immediately after a file open event.

Detection Strategies

Monitor endpoint telemetry for Substance 3D Stager processes opening files from user download directories, browser cache paths, or email attachment folders.
Alert on Substance 3D Stager child processes spawning shells, scripting engines, or network utilities, which would indicate chained exploitation.
Inventory installed versions of Substance 3D Stager across managed endpoints and flag any instance at version 3.1.3 or earlier.

Monitoring Recommendations

Enable file integrity monitoring on shared asset repositories used by design and 3D content teams.
Collect crash dumps from Substance 3D Stager and review them for access violations in file parsing routines.
Correlate file open events with subsequent process behavior using EDR telemetry to identify suspicious sequences.

How to Mitigate CVE-2025-54237

Immediate Actions Required

Upgrade Adobe Substance 3D Stager to the fixed version listed in Adobe Security Bulletin APSB25-81.
Instruct users to avoid opening Substance 3D Stager files received from unverified sources until patching is complete.
Audit endpoints for outdated installations of Substance 3D Stager and prioritize workstations belonging to 3D artists and content creators.

Patch Information

Adobe released a fixed build for Substance 3D Stager alongside advisory APSB25-81. Administrators should deploy the update through Adobe Creative Cloud or the enterprise deployment channel used in their environment. Verify the installed version after upgrade to confirm remediation.

Workarounds

Restrict Substance 3D Stager to loading files only from vetted internal asset libraries and network shares.
Apply application allowlisting and Mark-of-the-Web enforcement so files from the internet trigger additional user warnings.
Segment 3D content workstations from sensitive systems to limit the value of any memory disclosed through this flaw.

bash

# Verify installed Substance 3D Stager version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Stager" /s | findstr /i version

# Verify installed Substance 3D Stager version on macOS
defaults read "/Applications/Adobe Substance 3D Stager/Adobe Substance 3D Stager.app/Contents/Info.plist" CFBundleShortVersionString