CVE-2025-54244: Adobe Substance 3D Viewer Buffer Overflow

CVE-2025-54244 Overview

CVE-2025-54244 is a heap-based buffer overflow vulnerability [CWE-122] affecting Adobe Substance 3D Viewer versions 0.25.1 and earlier. Successful exploitation allows arbitrary code execution in the context of the current user. The vulnerability requires user interaction: a victim must open a malicious file crafted by the attacker. Adobe published the issue in advisory APSB25-89 on September 9, 2025.

Critical Impact
Attackers can achieve arbitrary code execution with the privileges of the user running Substance 3D Viewer after tricking them into opening a crafted 3D asset file.

Affected Products

Adobe Substance 3D Viewer version 0.25.1
All Adobe Substance 3D Viewer versions prior to 0.25.1
Windows and macOS installations of the affected versions

Discovery Timeline

2025-09-09 - CVE-2025-54244 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54244

Vulnerability Analysis

The flaw is a heap-based buffer overflow inside Adobe Substance 3D Viewer's file parsing logic. When the application processes a malicious 3D asset, it writes beyond the bounds of a heap-allocated buffer. This memory corruption can overwrite adjacent heap metadata or object pointers used by the viewer. An attacker who controls the overflowed data can redirect execution flow and run arbitrary code under the current user account. Exploitation is local and requires the victim to open the malicious file, but no elevated privileges are needed on the target system.

Root Cause

The vulnerability stems from improper validation of size or length values while parsing untrusted 3D file content. The parser allocates a heap buffer based on assumptions about input structure, then copies attacker-controlled data without enforcing bounds. This condition maps to CWE-122, heap-based buffer overflow. Adobe's advisory APSB25-89 documents the issue but does not disclose the specific file format component that mishandles input.

Attack Vector

The attack vector is local and user-assisted. An attacker delivers a crafted 3D asset through phishing email, a compromised website, a shared project file, or a supply chain of downloadable asset libraries. When the victim opens the file in Substance 3D Viewer, the parser triggers the overflow. Successful exploitation grants code execution at the privilege level of the user who launched the viewer, enabling credential theft, persistence, or lateral movement.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical context, refer to the Adobe Security Advisory APSB25-89.

Detection Methods for CVE-2025-54244

Indicators of Compromise

Unexpected child processes spawned by the Adobe Substance 3D Viewer.exe process, such as cmd.exe, powershell.exe, or bash.
Crashes or exception events in Substance 3D Viewer shortly after opening a 3D asset file received from an external source.
Newly created executables, scripts, or scheduled tasks in the user profile directory following a viewer session.
Outbound network connections initiated by the viewer process to unknown external hosts.

Detection Strategies

Monitor endpoint telemetry for anomalous process lineage where Substance 3D Viewer spawns interpreters, shells, or LOLBins.
Alert on heap corruption exception codes (for example 0xC0000374) in Windows Error Reporting associated with the viewer executable.
Inspect email and web gateways for inbound 3D asset file types such as .glb, .gltf, .fbx, .usd, and .obj from untrusted senders.
Correlate file-open events on 3D assets with subsequent process creation or file write activity in user directories.

Monitoring Recommendations

Enable command-line and process creation auditing on workstations that run Adobe Substance 3D Viewer.
Forward endpoint, EDR, and application crash logs to a centralized SIEM for correlation and retention.
Track software inventory to identify systems still running Substance 3D Viewer 0.25.1 or earlier.

How to Mitigate CVE-2025-54244

Immediate Actions Required

Update Adobe Substance 3D Viewer to the fixed version identified in Adobe advisory APSB25-89 on all affected endpoints.
Instruct users to avoid opening 3D asset files received from untrusted or unexpected sources until patching is complete.
Prioritize patching on workstations used by designers, 3D artists, and other users who routinely handle external asset files.
Verify endpoint protection is active and up to date on all systems running the viewer.

Patch Information

Adobe released a security update addressing CVE-2025-54244 as documented in Adobe Security Advisory APSB25-89. Administrators should download the latest Substance 3D Viewer release from Adobe's official distribution channels and validate the installed version after deployment.

Workarounds

Restrict execution of Substance 3D Viewer through application allowlisting until patches are applied enterprise-wide.
Block or quarantine inbound 3D asset file types at email and web gateways when senders are unverified.
Run the viewer under a standard user account without administrative privileges to limit post-exploitation impact.
Enable operating system exploit mitigations such as Windows Defender Exploit Guard and macOS System Integrity Protection.

bash

# Windows: check installed Substance 3D Viewer version
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like "*Substance 3D Viewer*" } |
  Select-Object DisplayName, DisplayVersion, Publisher