CVE-2025-61802 Overview
CVE-2025-61802 is a Use After Free vulnerability [CWE-416] in Adobe Substance 3D Stager versions 3.1.4 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Adobe published the security advisory APSB25-104 documenting the issue and a corrected release.
The vulnerability requires local access and user interaction. An attacker must deliver a crafted project or asset file and convince the user to open it within Substance 3D Stager. Successful exploitation produces code execution with the privileges of the logged-in user.
Critical Impact
Arbitrary code execution in the context of the current user after opening a malicious Substance 3D Stager file.
Affected Products
- Adobe Substance 3D Stager 3.1.4 and earlier
- Apple macOS installations running affected Stager versions
- Microsoft Windows installations running affected Stager versions
Discovery Timeline
- 2025-10-14 - CVE-2025-61802 published to NVD
- 2025-10-14 - Adobe publishes advisory APSB25-104
- 2025-10-16 - Last updated in NVD database
Technical Details for CVE-2025-61802
Vulnerability Analysis
The vulnerability is a Use After Free condition [CWE-416] in Adobe Substance 3D Stager. Use After Free flaws occur when a program continues to reference memory after it has been released back to the allocator. An attacker who controls the layout of the freed region can place attacker-controlled data where the dangling pointer is later dereferenced.
In Substance 3D Stager, the unsafe reference is triggered during the parsing or processing of a malicious file. The application frees an object during file ingestion but retains a stale pointer that is later used to read or write memory. This primitive can be converted into arbitrary code execution within the host process.
Exploitation runs entirely in the context of the current user. The attacker inherits the file system, registry, and network permissions of the targeted account. On workstations used by 3D artists, that context frequently includes access to project repositories, asset libraries, and cloud storage credentials.
Root Cause
The root cause is improper lifetime management of an object referenced during file parsing. The object is freed while a pointer to it remains reachable. Subsequent dereference of the dangling pointer corrupts the process memory state.
Attack Vector
The attack vector is local with required user interaction. An attacker crafts a malicious Stager project or asset file and delivers it through phishing, file-sharing platforms, or compromised asset marketplaces. The victim opens the file in Substance 3D Stager 3.1.4 or earlier, which triggers the Use After Free and executes the attacker's payload.
No authentication is required to craft or distribute the file. The vulnerability cannot be triggered remotely without user action, but the social engineering surface is broad because 3D artists routinely exchange asset files.
No verified public exploitation code or proof-of-concept is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-61802
Indicators of Compromise
- Unexpected child processes spawned by Adobe Substance 3D Stager.exe or the macOS equivalent binary
- Stager process crashes or abnormal termination immediately after opening a third-party file
- Outbound network connections initiated by the Stager process to non-Adobe domains
- Newly written executables or scripts in user-writable directories following Stager file open events
Detection Strategies
- Monitor process creation events where Substance 3D Stager is the parent process and the child is a shell, scripting host, or LOLBin
- Alert on Stager loading unsigned or unexpected DLLs and dylibs from user-writable paths
- Correlate Stager crash telemetry with subsequent persistence or credential access activity on the same host
Monitoring Recommendations
- Inventory endpoints running Adobe Substance 3D Stager and flag versions at or below 3.1.4
- Track file open telemetry for Stager project files originating from email attachments, web downloads, or removable media
- Forward endpoint telemetry to a centralized data lake for retrospective hunting against this CVE
How to Mitigate CVE-2025-61802
Immediate Actions Required
- Upgrade Adobe Substance 3D Stager to the version listed as fixed in Adobe Security Advisory APSB25-104
- Restrict opening of Stager files received from untrusted sources until patching is complete
- Communicate the risk to 3D and design teams that handle external asset files regularly
Patch Information
Adobe addressed the vulnerability in the release documented in Adobe Security Advisory APSB25-104. Administrators should deploy the fixed version on all Windows and macOS endpoints running Substance 3D Stager.
Workarounds
- Block inbound delivery of Substance 3D Stager project files at email and web gateways where business need does not exist
- Run Substance 3D Stager under standard user accounts without local administrator rights to limit post-exploitation impact
- Apply application allow-listing to prevent Stager from launching unexpected child processes such as cmd.exe, powershell.exe, or bash
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
