CVE-2025-54275: Adobe Substance 3D Viewer DOS Vulnerability

CVE-2025-54275 is a denial-of-service vulnerability in Adobe Substance 3D Viewer caused by an out-of-bounds write flaw. Attackers can crash the application by tricking users into opening malicious files. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-54275 Overview

Adobe Substance 3D Viewer versions 0.25.2 and earlier contain an out-of-bounds write vulnerability [CWE-787] that can trigger a denial-of-service condition. An attacker crafts a malicious file that, when opened by a victim, causes the application to write beyond allocated memory boundaries. The result is an application crash or unresponsive state. Exploitation requires user interaction because the victim must open the malicious file. The vulnerability is local in scope and does not affect confidentiality or integrity, only availability.

Critical Impact
A crafted 3D asset file can crash Adobe Substance 3D Viewer, interrupting design workflows and forcing application restarts on affected workstations.

Affected Products

Adobe Substance 3D Viewer version 0.25.2
Adobe Substance 3D Viewer versions earlier than 0.25.2
All supported desktop platforms running the affected builds

Discovery Timeline

2025-10-14 - CVE-2025-54275 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54275

Vulnerability Analysis

The flaw is an out-of-bounds write in the file parsing logic of Adobe Substance 3D Viewer. When the application processes a malformed 3D asset, it writes data past the end of an allocated buffer. This memory corruption destabilizes the process and terminates execution. Adobe classifies the impact as application denial-of-service, meaning the vulnerability does not expose data or grant code execution in its disclosed form. However, out-of-bounds write conditions can sometimes be escalated by skilled attackers, so patching remains important. Exploitation is confined to the local user context because the attacker cannot reach the vulnerable code path without file input from the victim.

Root Cause

The root cause is insufficient bounds checking during deserialization of untrusted 3D file content. The parser accepts attacker-controlled size or offset values and uses them without validation when writing to a buffer. This aligns with the CWE-787 pattern of out-of-bounds writes in file format parsers.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted asset file through email, chat, a shared project repository, or a compromised asset marketplace. When the victim opens the file in Substance 3D Viewer, the malformed structure triggers the out-of-bounds write and crashes the application.

No verified public proof-of-concept is available. Refer to the Adobe Security Bulletin
APSB25-99 for vendor guidance and patch details.

Detection Methods for CVE-2025-54275

Indicators of Compromise

Unexpected termination of the Adobe Substance 3D Viewer process shortly after opening a 3D asset file
Windows Error Reporting or macOS CrashReporter entries referencing the Substance 3D Viewer executable
Inbound 3D asset files (.glb, .gltf, .fbx, .usd, and related formats) from untrusted senders or unusual sources

Detection Strategies

Correlate application crash events with recent file-open activity to identify malicious asset delivery
Monitor endpoint telemetry for repeated crashes of Adobe Substance 3D Viewer across multiple users, which may indicate a targeted campaign
Inspect email and collaboration platforms for 3D asset attachments originating outside trusted design partners

Monitoring Recommendations

Enable crash dump collection on workstations running Substance 3D Viewer to support post-incident analysis
Track installed versions of Substance 3D Viewer through software inventory tooling and flag any host running 0.25.2 or earlier
Alert on file downloads of 3D asset formats from web categories not associated with approved vendors

How to Mitigate CVE-2025-54275

Immediate Actions Required

Update Adobe Substance 3D Viewer to the fixed release identified in Adobe Security Bulletin APSB25-99
Instruct users not to open 3D asset files from unverified sources until patching is complete
Restrict Substance 3D Viewer installations to workstations that require it as part of documented workflows

Patch Information

Adobe published fixed builds in security bulletin APSB25-99. Administrators should deploy the vendor-supplied update to all endpoints running version 0.25.2 or earlier. Refer to the Adobe Security Bulletin APSB25-99 for the exact fixed version and download links.

Workarounds

Block delivery of unsolicited 3D asset files at email and web gateways until patches are applied
Open untrusted assets only inside isolated virtual machines or sandboxed environments
Apply application allowlisting policies that limit which users can launch Substance 3D Viewer

bash

# Example: query installed Substance 3D Viewer version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Viewer" /s | findstr /I "Version"