CVE-2025-54280: Adobe Substance 3D Viewer RCE Vulnerability

CVE-2025-54280 Overview

CVE-2025-54280 is an out-of-bounds write vulnerability [CWE-787] in Adobe Substance 3D Viewer versions 0.25.2 and earlier. The flaw allows attackers to execute arbitrary code in the context of the current user. Exploitation requires a victim to open a malicious file crafted by the attacker.

Adobe published a security advisory tracked as APSB25-99 addressing this issue. The vulnerability carries a CVSS 3.1 base score of 7.8 and impacts confidentiality, integrity, and availability. Because exploitation depends on user interaction, attackers typically pair this bug with social engineering or phishing campaigns to deliver weaponized 3D asset files.

Critical Impact
Successful exploitation results in arbitrary code execution under the privileges of the logged-in user opening a malicious file in Substance 3D Viewer.

Affected Products

Adobe Substance 3D Viewer version 0.25.2
All Adobe Substance 3D Viewer versions prior to 0.25.2
Windows and macOS installations of the affected versions

Discovery Timeline

2025-10-14 - CVE-2025-54280 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54280

Vulnerability Analysis

The vulnerability is an out-of-bounds write classified under [CWE-787]. Substance 3D Viewer parses complex 3D asset and scene file formats during file open operations. When the application processes a malformed input file, it writes data past the boundary of an allocated buffer.

Out-of-bounds writes corrupt adjacent memory structures such as heap metadata, function pointers, or vtables. Attackers leverage this corruption to redirect program execution to attacker-controlled code. The attack runs at local privilege, meaning the malicious payload executes with the same rights as the user who opened the file.

This class of memory corruption is common in native applications handling untrusted binary file formats. Substance 3D Viewer supports several mesh, texture, and material formats that involve complex parsing routines.

Root Cause

The root cause is missing or incorrect bounds checking in the file parsing logic. Length or index values derived from the malicious file are used to compute a write destination without proper validation against the allocated buffer size. The exact vulnerable component has not been disclosed by Adobe in the public advisory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted 3D asset file through email attachments, file-sharing services, compromised websites, or supply chain channels. Upon opening the file in a vulnerable Substance 3D Viewer build, the parser triggers the out-of-bounds write and the attacker's shellcode runs.

No verified public exploit code or proof-of-concept is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-54280

Indicators of Compromise

Unexpected child processes spawned by the Substance 3D Viewer executable, particularly command shells, scripting hosts, or LOLBins
Substance 3D Viewer process crashes followed by suspicious file or registry modifications
3D asset files arriving from untrusted sources with unusual file sizes or malformed headers
Outbound network connections originating from the Substance 3D Viewer process to unknown hosts

Detection Strategies

Hunt for process lineage where Substance 3D Viewer launches cmd.exe, powershell.exe, wscript.exe, or shell binaries on macOS
Monitor for memory access violations and Windows Error Reporting events tied to the Substance 3D Viewer process
Inspect endpoint telemetry for file write operations to autorun locations performed by or following a Substance 3D Viewer session

Monitoring Recommendations

Centralize endpoint process, file, and network telemetry to support retroactive hunts for suspicious Substance 3D Viewer activity
Alert on installations of Substance 3D Viewer versions at or below 0.25.2 discovered through software inventory
Track delivery of 3D asset file types (such as .sbsar, .fbx, .glb, .usd) from external email senders

How to Mitigate CVE-2025-54280

Immediate Actions Required

Upgrade Substance 3D Viewer to the fixed version listed in Adobe Security Advisory APSB25-99
Inventory all endpoints running Substance 3D Viewer and prioritize systems used by designers handling external 3D content
Block or quarantine 3D asset files received from untrusted external senders until patching completes

Patch Information

Adobe addressed CVE-2025-54280 in the update referenced by Adobe Security Advisory APSB25-99. Administrators should apply the vendor-supplied update to all installations of Substance 3D Viewer version 0.25.2 and earlier.

Workarounds

Restrict opening of 3D asset files to those originating from verified, trusted sources
Run Substance 3D Viewer under a standard user account rather than an administrative account to limit post-exploitation impact
Apply application allowlisting to prevent Substance 3D Viewer from spawning interpreters or shell processes

bash

# Example: Windows PowerShell inventory check for vulnerable installations
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like "*Substance 3D Viewer*" } |
  Select-Object Name, Version, InstallDate