CVE-2025-61807: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-61807 Overview

CVE-2025-61807 is an integer overflow or wraparound vulnerability [CWE-190] affecting Adobe Substance 3D Stager versions 3.1.4 and earlier. An attacker who convinces a victim to open a crafted file can trigger arbitrary code execution in the context of the current user. Exploitation requires local file access and user interaction, but no authentication. The flaw affects installations on both Microsoft Windows and Apple macOS. Adobe addressed the issue in security bulletin APSB25-104.

Critical Impact
Successful exploitation results in arbitrary code execution with the privileges of the user running Substance 3D Stager, enabling full compromise of confidentiality, integrity, and availability on the affected workstation.

Affected Products

Adobe Substance 3D Stager versions 3.1.4 and earlier
Microsoft Windows installations of Substance 3D Stager
Apple macOS installations of Substance 3D Stager

Discovery Timeline

2025-10-14 - CVE-2025-61807 published to the National Vulnerability Database
2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-61807

Vulnerability Analysis

The vulnerability is classified under [CWE-190] Integer Overflow or Wraparound. Substance 3D Stager performs arithmetic on values derived from untrusted file input without adequately validating the result. When the computed value exceeds the maximum representable size for its integer type, it wraps around to a small or negative value.

Downstream code uses this corrupted value for size calculations, memory allocations, or loop bounds. The mismatch between the allocated buffer and the actual data processed leads to memory corruption. An attacker who controls the input file can shape the corruption to redirect execution flow into attacker-supplied instructions.

Because Substance 3D Stager runs in user context, code executed through this flaw inherits the user's privileges, file access, and network reachability. The attack vector is local and user interaction is required, but no privileges or prior authentication are needed on the target system.

Root Cause

The root cause is missing or insufficient validation of integer values parsed from a Substance 3D asset or project file. Specific arithmetic operations on length, count, or offset fields overflow the native integer type before being passed to memory management routines. Adobe has not published the exact field or parser path responsible.

Attack Vector

An attacker crafts a malicious 3D asset, scene, or project file containing oversized numeric fields engineered to overflow when multiplied or summed by the parser. The attacker delivers the file through phishing email, a compromised asset marketplace, a shared collaboration drive, or a watering-hole site that targets 3D artists and designers. When the victim opens the file in Substance 3D Stager, the parser performs the unchecked arithmetic and corrupts memory, allowing the attacker to gain arbitrary code execution. Refer to the Adobe Security Advisory APSB25-104 for vendor guidance.

// No verified proof-of-concept code is publicly available for CVE-2025-61807.
// The vulnerability is triggered by parsing a malicious project or asset file
// that contains crafted numeric fields designed to overflow size calculations
// inside Substance 3D Stager <= 3.1.4.

Detection Methods for CVE-2025-61807

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe on Windows or the Adobe Substance 3D Stager binary on macOS, such as shells, scripting interpreters, or rundll32.
Substance 3D Stager processes establishing outbound network connections to unfamiliar hosts shortly after a project or asset file is opened.
Writes to autorun locations, scheduled tasks, or LaunchAgents created by the Stager process or its children.
Substance 3D Stager process crashes with access violation or EXC_BAD_ACCESS exceptions correlated with opening a third-party asset file.

Detection Strategies

Hunt for Substance 3D Stager spawning interpreters (powershell.exe, cmd.exe, wscript.exe, osascript, bash, python) using EDR process-lineage telemetry.
Inspect recently opened files referenced in Stager configuration and recent-files lists, correlating with file delivery channels such as email attachments and downloads.
Apply YARA or content rules against incoming 3D asset files for anomalous header values, oversized count fields, and inconsistent size metadata.

Monitoring Recommendations

Forward endpoint process, file, and network telemetry to a centralized SIEM and alert on Substance 3D Stager process anomalies.
Monitor crash reports from Stager workstations and triage repeated crashes that involve memory corruption signatures.
Track installed versions of Substance 3D Stager across the fleet and flag any host running 3.1.4 or earlier.

How to Mitigate CVE-2025-61807

Immediate Actions Required

Inventory all Windows and macOS endpoints running Adobe Substance 3D Stager and identify hosts on version 3.1.4 or earlier.
Update Substance 3D Stager to the fixed version listed in Adobe Security Advisory APSB25-104.
Instruct users not to open Substance 3D project or asset files received from untrusted sources until patches are deployed.
Validate the patch deployment through software inventory or configuration management tooling.

Patch Information

Adobe published the official fix in security bulletin APSB25-104. Users should upgrade Substance 3D Stager to the version specified in the advisory. The advisory and download links are available at Adobe Security Advisory APSB25-104.

Workarounds

Restrict Substance 3D Stager usage to trusted asset files originating from internal or verified sources until patching is complete.
Enforce least-privilege accounts for designers and artists so that exploitation does not yield administrative rights.
Use application allow-listing and email attachment filtering to limit delivery of unsolicited 3D project files.

bash

# Windows: check installed Substance 3D Stager version via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# macOS: check installed Substance 3D Stager version
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Stager.app"