CVE-2025-61833: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-61833 Overview

CVE-2025-61833 is an out-of-bounds read vulnerability in Adobe Substance 3D Stager versions 3.1.5 and earlier. The flaw occurs when the application parses a crafted file, allowing a read past the end of an allocated memory structure [CWE-125]. An attacker who convinces a user to open a malicious file can execute code in the context of the current user. Exploitation requires local user interaction, limiting mass exploitation but enabling targeted attacks against designers and 3D content creators.

Critical Impact
Successful exploitation results in arbitrary code execution under the privileges of the logged-in user, with high impact to confidentiality, integrity, and availability.

Affected Products

Adobe Substance 3D Stager versions 3.1.5 and earlier
Microsoft Windows installations of Substance 3D Stager
Apple macOS installations of Substance 3D Stager

Discovery Timeline

2025-11-11 - CVE-2025-61833 published to the National Vulnerability Database (NVD)
2025-11-12 - Last updated in NVD database
2025-11-11 - Adobe published Security Advisory APSB25-113 addressing the issue

Technical Details for CVE-2025-61833

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] triggered during file parsing in Substance 3D Stager. When the application processes a malformed 3D asset or project file, it reads memory beyond the boundary of an allocated buffer. The condition can be combined with other primitives to corrupt control flow and achieve arbitrary code execution within the user's session. Because Substance 3D Stager runs as the logged-on user, successful exploitation yields the same privileges that user holds on the workstation.

Root Cause

The root cause is insufficient bounds validation in the file parser. The application trusts size or offset values embedded in the input file without verifying them against the actual length of the allocated buffer. When a crafted file specifies fields that direct the parser beyond the buffer, the process reads adjacent memory. This adjacent memory may contain pointers, object metadata, or other data that an attacker can leverage to influence execution.

Attack Vector

The attack vector is local and requires user interaction. An attacker must deliver a crafted Substance 3D Stager file to the victim through email, a shared project repository, a download link, or a collaboration platform. The victim must then open the file in a vulnerable version of Substance 3D Stager. No elevated privileges or prior authentication on the target system are required. Refer to the Adobe Security Advisory APSB25-113 for vendor-supplied technical context. No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-61833

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe (Windows) or the Stager binary (macOS), particularly shells, scripting interpreters, or rundll32.
Substance 3D Stager process crashes or access-violation events recorded shortly after opening an externally sourced project file.
Inbound 3D project files (.sbs, .stager, .fbx, .glb, .obj, and related asset formats) arriving from untrusted sources or unusual senders.

Detection Strategies

Monitor endpoint telemetry for anomalous process lineage where Substance 3D Stager is the parent of command-line, PowerShell, or persistence-related processes.
Inspect application crash logs and Windows Error Reporting events referencing the Stager process and access-violation exception codes.
Correlate file-open events for 3D asset extensions with subsequent outbound network connections initiated by the Stager process.

Monitoring Recommendations

Track installed versions of Adobe Substance 3D Stager across the fleet and alert when a host runs 3.1.5 or earlier.
Log and review email or collaboration platform deliveries of 3D project file types to creative workstations.
Enable memory protection telemetry (DEP, ASLR, CFG) and capture exploitation-attempt events on hosts running creative tooling.

How to Mitigate CVE-2025-61833

Immediate Actions Required

Update Adobe Substance 3D Stager to the fixed version identified in Adobe Security Advisory APSB25-113.
Instruct users not to open Substance 3D Stager files received from unverified sources or external collaborators until patches are applied.
Inventory all Windows and macOS endpoints running Substance 3D Stager and prioritize patch deployment on creative and design workstations.

Patch Information

Adobe addressed CVE-2025-61833 in the security update referenced by advisory APSB25-113, published on 2025-11-11. Administrators should download the latest version through the Adobe Creative Cloud desktop application or from the vendor advisory. See the Adobe Security Advisory APSB25-113 for the fixed build details.

Workarounds

Restrict the opening of Substance 3D Stager project files to those originating from trusted internal repositories.
Run Substance 3D Stager under standard (non-administrative) user accounts to limit the impact of code execution.
Apply application allow-listing or attack-surface-reduction rules that block Substance 3D Stager from spawning script interpreters and shells.

bash

# Verify installed Substance 3D Stager version on Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# Verify installed Substance 3D Stager version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Stager/Adobe Substance 3D Stager.app"