CVE-2025-54243: Adobe Substance 3D Viewer RCE Vulnerability

CVE-2025-54243 Overview

CVE-2025-54243 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Substance 3D Viewer versions 0.25.1 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Adobe published a security bulletin tracking this issue as APSB25-89.

Exploitation requires user interaction. An attacker must convince a target to open a crafted file in Substance 3D Viewer. The attack vector is local, and no privileges are required prior to exploitation.

Critical Impact

Successful exploitation grants arbitrary code execution under the privileges of the user running Substance 3D Viewer, enabling full compromise of confidentiality, integrity, and availability on the affected workstation.

Affected Products

• Adobe Substance 3D Viewer 0.25.1
• Adobe Substance 3D Viewer versions prior to 0.25.1
• Windows and macOS installations running vulnerable Substance 3D Viewer builds

Discovery Timeline

• 2025-09-09 - CVE-2025-54243 published to the National Vulnerability Database
• 2025-09-12 - Last updated in NVD database

Technical Details for CVE-2025-54243

Vulnerability Analysis

The vulnerability is an out-of-bounds write in Adobe Substance 3D Viewer's file parsing logic. When the application processes a malformed 3D asset or scene file, it writes data past the bounds of an allocated buffer. The resulting memory corruption can be steered by an attacker to overwrite adjacent objects, function pointers, or control-flow structures, leading to arbitrary code execution.

Because the vulnerable code path is reached through normal file-open functionality, the malicious payload can be embedded in any supported asset format. Refer to the Adobe Security Bulletin APSB25-89 for vendor-confirmed technical scope.

Root Cause

The root cause is missing or insufficient bounds validation when copying attacker-controlled data from a file into an in-memory buffer. The parser trusts size or offset fields supplied by the input file and uses them in a write operation without verifying that the destination buffer can accommodate the data.

Attack Vector

The attack requires local access in the form of file delivery and user interaction. A typical chain involves phishing, watering-hole download, or supply-chain delivery of a malicious 3D asset. When the victim opens the file in Substance 3D Viewer, the parser triggers the out-of-bounds write and executes the embedded payload in the user's session.

No verified proof-of-concept code or exploit module has been published. No public details on the specific corrupted structure are available beyond the vendor advisory.

Detection Methods for CVE-2025-54243

Indicators of Compromise

• Unexpected child processes spawned by Adobe Substance 3D Viewer.exe or the macOS equivalent binary
• Substance 3D Viewer process crashes or access violations correlated with opening externally sourced 3D asset files
• New persistence artifacts (Run keys, scheduled tasks, LaunchAgents) created shortly after a user opens a Substance 3D asset
• Outbound network connections from the Substance 3D Viewer process to non-Adobe infrastructure

Detection Strategies

• Hunt for process-lineage anomalies where Substance 3D Viewer is the parent of cmd.exe, powershell.exe, bash, or scripting interpreters
• Alert on Substance 3D Viewer loading unsigned or unexpected DLLs and dylibs from user-writable paths
• Inspect email and download gateways for inbound 3D asset formats (such as .glb, .fbx, .obj, .sbsar) from untrusted senders

Monitoring Recommendations

• Collect endpoint telemetry for module loads, file writes, and network connections originating from Substance 3D Viewer processes
• Track installed Substance 3D Viewer versions across the fleet and flag any host running 0.25.1 or earlier
• Forward crash telemetry from creative workstations to a central SIEM to surface exploitation attempts that fail before achieving code execution

How to Mitigate CVE-2025-54243

Immediate Actions Required

• Upgrade Adobe Substance 3D Viewer to the fixed version listed in Adobe Security Bulletin APSB25-89
• Inventory all workstations with Substance 3D Viewer installed and prioritize patching for creative, design, and marketing teams
• Instruct users to open 3D assets only from trusted internal sources until patching is complete

Patch Information

Adobe has released an updated build of Substance 3D Viewer that remediates CVE-2025-54243. Administrators should consult Adobe Security Bulletin APSB25-89 for the fixed version number and download links, and deploy through Adobe Creative Cloud or the organization's software distribution platform.

Workarounds

• Block inbound delivery of 3D asset file types from external senders at the email gateway until patches are deployed
• Run Substance 3D Viewer under a standard (non-administrative) user account to limit post-exploitation impact
• Apply application control policies that restrict Substance 3D Viewer from spawning shells or scripting interpreters

# Example: enumerate Substance 3D Viewer versions on Windows endpoints via PowerShell
Get-ChildItem 'C:\Program Files\Adobe' -Recurse -Filter 'Adobe Substance 3D Viewer.exe' |
  ForEach-Object {
    [PSCustomObject]@{
      Path    = $_.FullName
      Version = (Get-Item $_.FullName).VersionInfo.ProductVersion
    }
  }