CVE-2025-61805: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-61805 Overview

CVE-2025-61805 is an out-of-bounds read vulnerability affecting Adobe Substance 3D Stager versions 3.1.4 and earlier. The flaw occurs when the application parses a crafted file, allowing a read past the end of an allocated memory structure. An attacker can leverage this condition to execute code in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file delivered through phishing, file sharing, or another social engineering vector.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the current user, leading to full compromise of confidentiality, integrity, and availability on the affected workstation.

Affected Products

Adobe Substance 3D Stager versions 3.1.4 and earlier
Apple macOS installations running affected Substance 3D Stager versions
Microsoft Windows installations running affected Substance 3D Stager versions

Discovery Timeline

2025-10-14 - CVE-2025-61805 published to the National Vulnerability Database
2025-10-14 - Adobe publishes Security Advisory APSB25-104
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61805

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in the file parsing logic of Adobe Substance 3D Stager. When the application processes a malformed input file, the parser reads memory beyond the bounds of an allocated buffer or structure. This out-of-bounds access can expose adjacent process memory and corrupt internal state used for subsequent operations.

Adobe's advisory indicates the issue can lead to arbitrary code execution in the user context. While out-of-bounds read primitives traditionally enable information disclosure, attackers can chain them with object layout knowledge or auxiliary memory corruption to redirect control flow. The local attack vector with required user interaction aligns with a typical client-side document handling exploit chain.

Root Cause

The root cause is missing or insufficient bounds validation during deserialization of a 3D scene or asset file. The parser trusts size or offset fields embedded in the file without verifying that subsequent reads remain within the allocated structure. Crafted values cause the read pointer to cross the buffer boundary into unrelated heap memory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious Substance 3D Stager project, scene, or asset file through email, instant messaging, a compromised website, or a shared design repository. When the victim opens the file in a vulnerable version of Stager, the parser triggers the out-of-bounds read. Code execution then runs with the privileges of the logged-in user, providing a foothold for credential theft, lateral movement, or payload staging.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Adobe Security Advisory APSB25-104 for vendor technical details.

Detection Methods for CVE-2025-61805

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe (Windows) or the Stager binary (macOS), particularly shells, scripting interpreters, or rundll32.exe
Crashes or abnormal terminations of Substance 3D Stager logged in Windows Event Log or macOS unified logs after opening a file from an external source
Substance 3D Stager project files (.sbs, .sbsar, scene files) arriving from untrusted email senders or unfamiliar cloud storage links
New persistence artifacts (Run keys, LaunchAgents, scheduled tasks) created shortly after a Stager session

Detection Strategies

Inventory all endpoints running Adobe Substance 3D Stager and identify hosts on version 3.1.4 or earlier using software asset management telemetry
Hunt for process lineage anomalies where Stager spawns command interpreters, network utilities, or LOLBins
Monitor for outbound network connections originating from the Stager process to non-Adobe destinations
Correlate file open events for 3D asset formats with subsequent process creation events on the same host

Monitoring Recommendations

Enable detailed process creation auditing (Windows Event ID 4688 with command line, macOS Endpoint Security Framework) on workstations used by 3D designers
Forward EDR telemetry from creative workstations into a central data lake to support retrospective hunts as new indicators emerge
Alert on Substance 3D Stager crashes followed by user logon session anomalies or credential access events
Track email gateway and web proxy logs for delivery of 3D asset file types from external senders

How to Mitigate CVE-2025-61805

Immediate Actions Required

Upgrade Adobe Substance 3D Stager to the fixed version listed in Adobe Security Advisory APSB25-104 on all Windows and macOS endpoints
Instruct users to avoid opening Substance 3D Stager files received from untrusted or unverified sources until patching is complete
Restrict the delivery of 3D asset file types through email gateways and require sandbox detonation for external attachments
Verify that endpoint protection is active and policies block child process execution from creative applications where feasible

Patch Information

Adobe addressed CVE-2025-61805 in the security update referenced by advisory APSB25-104. Administrators should consult the advisory for the exact fixed version and deploy the update through Adobe Creative Cloud or enterprise software distribution tooling. Confirm successful patch deployment by validating the installed version on each endpoint against the version listed by Adobe.

Workarounds

Run Substance 3D Stager under a standard user account with no local administrator rights to limit the impact of code execution
Open untrusted 3D files only inside an isolated virtual machine or sandboxed environment disconnected from corporate resources
Apply application allowlisting to prevent Stager from launching unauthorized child processes
Disable file associations that automatically open Substance 3D asset files until patches are applied

bash

# Windows: query installed Substance 3D Stager version via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# macOS: query installed Substance 3D Stager version
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Stager.app"