CVE-2025-54245: Adobe Substance 3D Viewer RCE Vulnerability

CVE-2025-54245 Overview

CVE-2025-54245 is an out-of-bounds write vulnerability [CWE-787] in Adobe Substance 3D Viewer versions 0.25.1 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a crafted file. Exploitation requires user interaction, limiting opportunistic attacks but aligning with phishing and social engineering campaigns that distribute malicious 3D assets.

Adobe published the fix in security bulletin APSB25-89. No public proof-of-concept exists, and CISA has not added the issue to the Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation yields arbitrary code execution at the privilege level of the user running Substance 3D Viewer, enabling malware deployment, credential theft, and lateral movement from creative workstations.

Affected Products

Adobe Substance 3D Viewer 0.25.1
Adobe Substance 3D Viewer all prior releases
Windows and macOS installations of the affected versions

Discovery Timeline

2025-09-09 - CVE-2025-54245 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54245

Vulnerability Analysis

The vulnerability resides in Substance 3D Viewer's file parsing logic. When the application processes a malformed 3D asset, it writes data past the end of an allocated buffer. This out-of-bounds write [CWE-787] corrupts adjacent memory structures, including function pointers, vtables, or return addresses depending on heap layout.

An attacker who controls the malformed file content can shape the corruption to redirect execution to attacker-supplied code. The process then runs the payload with the privileges of the logged-in user. Because creative software often runs on workstations holding source assets, intellectual property, and cached cloud credentials, post-exploitation impact extends beyond the host.

The vulnerability is exploitable only locally and requires the victim to open the crafted file. Attackers typically deliver such payloads through phishing emails, compromised asset marketplaces, or supply-chain tampering of project files.

Root Cause

The root cause is missing or incorrect bounds checking when Substance 3D Viewer parses untrusted file structures. Length fields or index values in the input are not validated against the destination buffer size, causing the write operation to exceed allocated memory. Adobe has not published the specific parser or file format component affected.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a malicious 3D asset and delivers it through email, file sharing, asset libraries, or collaboration platforms. When the victim opens the file in Substance 3D Viewer, the parser triggers the out-of-bounds write and executes the embedded payload.

The vulnerability does not provide privilege escalation by itself. Attackers chain it with other techniques or rely on the user already holding sufficient privileges on the target system.

No public exploit code is available. Technical specifics are documented in the Adobe Security Advisory APSB25-89.

Detection Methods for CVE-2025-54245

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Viewer.exe, particularly cmd.exe, powershell.exe, or scripting hosts
Substance 3D Viewer crashes or abnormal termination shortly after opening a file from email, downloads, or removable media
Outbound network connections initiated by the Viewer process to non-Adobe infrastructure
New persistence artifacts (scheduled tasks, registry Run keys, LaunchAgents) created during a Viewer session

Detection Strategies

Hunt for process-tree anomalies where Substance 3D Viewer is the parent of interpreter or LOLBin binaries
Inspect crash telemetry and Windows Error Reporting logs for repeated faults in the Viewer parsing modules
Correlate file open events for 3D asset extensions with subsequent suspicious child process creation
Apply behavioral identification rules for memory corruption patterns such as ROP gadget execution from non-image memory regions

Monitoring Recommendations

Log process creation with command-line arguments on workstations running Substance 3D Viewer
Monitor file write activity in user profile and startup directories originating from the Viewer process
Alert on email attachments and downloads containing 3D asset file types from untrusted senders
Capture EDR telemetry on module loads inside the Viewer process to identify unsigned or anomalous DLLs

How to Mitigate CVE-2025-54245

Immediate Actions Required

Upgrade Adobe Substance 3D Viewer to the version listed in Adobe bulletin APSB25-89 on all Windows and macOS endpoints
Inventory creative workstations using software asset management to confirm no instances of version 0.25.1 or earlier remain
Restrict opening of 3D asset files from untrusted sources until patching is complete
Reinforce phishing awareness for design, marketing, and creative teams that handle 3D content

Patch Information

Adobe released fixed builds described in Adobe Security Advisory APSB25-89. Administrators should deploy the patched version through their managed software distribution channel and confirm version strings on endpoints after installation.

Workarounds

Block inbound email attachments with Substance 3D asset extensions at the mail gateway when business workflows allow
Run Substance 3D Viewer under a standard user account, never an administrator, to limit post-exploitation impact
Use application allowlisting to prevent the Viewer process from spawning interpreters and shell binaries
Isolate creative workstations on a network segment with restricted egress until all hosts are patched

bash

# Verify installed Substance 3D Viewer version on Windows
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Viewer*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation