CVE-2025-61803: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-61803 Overview

CVE-2025-61803 affects Adobe Substance 3D Stager versions 3.1.4 and earlier. The flaw is an integer overflow or wraparound condition [CWE-190] that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file crafted by an attacker. Adobe addressed the issue in security bulletin APSB25-104.

Critical Impact

Successful exploitation grants attackers arbitrary code execution with the privileges of the logged-on user, enabling malware deployment, credential theft, and lateral movement from the compromised workstation.

Affected Products

• Adobe Substance 3D Stager versions 3.1.4 and earlier
• Microsoft Windows installations of Substance 3D Stager
• Apple macOS installations of Substance 3D Stager

Discovery Timeline

• 2025-10-14 - CVE-2025-61803 published to the National Vulnerability Database
• 2025-10-14 - Adobe published security advisory APSB25-104
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61803

Vulnerability Analysis

The vulnerability resides in Adobe Substance 3D Stager, a desktop application used to compose, light, and render 3D scenes. The application parses complex scene and asset file formats during import operations. An integer overflow or wraparound condition occurs while the parser processes attacker-controlled size or length fields from a malicious file.

When the unchecked arithmetic wraps, the application allocates a buffer smaller than expected and subsequently writes attacker-controlled data beyond the intended bounds. This memory corruption can be steered to overwrite function pointers, virtual table entries, or return addresses, redirecting execution to attacker-supplied code.

Because the process runs with the privileges of the interactive user, code execution inherits access to user files, browser sessions, cloud credentials cached on the workstation, and any network resources reachable from that account.

Root Cause

The root cause is improper validation of size or count values used in memory allocation or copy operations within the file parsing logic. Untrusted integer values from the file are used in arithmetic operations without bounds checks, producing a wrapped value that bypasses sanity checks but still drives a downstream buffer operation.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious project, scene, or asset file through email, chat, a compromised website, or a shared asset library. When the victim opens the file in a vulnerable build of Substance 3D Stager, the overflow triggers during parsing and the embedded payload executes.

No authentication is required against Substance 3D Stager itself, and no elevated privileges are needed to trigger the bug. Confidentiality, integrity, and availability impacts are all high on the affected host.

No verified public proof-of-concept code has been published for this issue. See the Adobe Security Advisory APSB25-104 for vendor technical guidance.

Detection Methods for CVE-2025-61803

Indicators of Compromise

• Unexpected child processes spawned by Adobe Substance 3D Stager.exe (Windows) or the macOS bundle, particularly shells, scripting hosts, or rundll32.exe.
• Substance 3D Stager performing outbound network connections to non-Adobe domains shortly after opening a file.
• Crash dumps or Windows Error Reporting entries referencing access violations inside Substance 3D Stager modules.
• Newly created executables, scripts, or scheduled tasks written by the Stager process to user-writable paths.

Detection Strategies

• Build EDR rules that alert on Substance 3D Stager spawning interpreters (powershell.exe, cmd.exe, wscript.exe, osascript, bash).
• Monitor for executable file writes originating from the Stager process tree, especially under %APPDATA%, %TEMP%, or ~/Library/Application Support.
• Inspect email and file-sharing gateways for inbound .ssa, .sbsar, .fbx, .glb, and similar 3D asset files from untrusted senders.
• Correlate process crashes of Stager with subsequent suspicious activity on the same host within a short time window.

Monitoring Recommendations

• Inventory all endpoints running Substance 3D Stager and track installed versions against the patched release.
• Forward Stager process telemetry, file writes, and network connections to a central log platform for retrospective hunting.
• Enable application crash and exploit-protection logging on Windows (WER, Exploit Guard) and macOS (CrashReporter) for the Stager binary.

How to Mitigate CVE-2025-61803

Immediate Actions Required

• Upgrade Adobe Substance 3D Stager to the fixed version listed in APSB25-104 on all Windows and macOS endpoints.
• Instruct users to avoid opening Substance 3D project or asset files received from untrusted or unverified sources until patches are deployed.
• Restrict Substance 3D Stager execution to standard user accounts, never administrators, to limit the blast radius of code execution.

Patch Information

Adobe released fixed builds of Substance 3D Stager addressing this issue in security bulletin APSB25-104. Users on version 3.1.4 and earlier must update through the Adobe Creative Cloud desktop application or the Adobe download center.

Workarounds

• Block delivery of 3D asset file types at email and web gateways for users who do not require them.
• Use application allow-listing to prevent unpatched Stager builds from launching on managed endpoints.
• Open untrusted 3D content only in isolated virtual machines or sandboxed user profiles without network access.

# Windows: query installed Substance 3D Stager version via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# macOS: query installed Substance 3D Stager version
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Stager.app"