CVE-2025-61835: Adobe Substance 3D Stager RCE Vulnerability

CVE-2025-61835 Overview

CVE-2025-61835 is an integer underflow vulnerability [CWE-191] affecting Adobe Substance 3D Stager versions 3.1.5 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Adobe published this issue on November 11, 2025, alongside security bulletin APSB25-113.

Exploitation requires user interaction, which limits scalability but aligns with common phishing and social engineering workflows targeting 3D content creators. The vulnerability impacts both Windows and macOS installations of Substance 3D Stager.

Critical Impact
Successful exploitation enables arbitrary code execution with the privileges of the user running Substance 3D Stager, potentially leading to full workstation compromise.

Affected Products

Adobe Substance 3D Stager versions 3.1.5 and earlier
Microsoft Windows installations of Substance 3D Stager
Apple macOS installations of Substance 3D Stager

Discovery Timeline

2025-11-11 - CVE-2025-61835 published to NVD
2025-11-11 - Adobe releases security bulletin APSB25-113
2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-61835

Vulnerability Analysis

The vulnerability is classified as an integer underflow, also known as wrap or wraparound [CWE-191]. Integer underflows occur when arithmetic on an unsigned integer produces a value below zero, causing the value to wrap to a very large positive number. In file parsing code paths, this commonly results in undersized buffer allocations or oversized memory operations that corrupt adjacent heap structures.

In Substance 3D Stager, the underflow is triggered during the processing of a crafted file. Once memory corruption occurs, an attacker can steer execution flow to attacker-controlled code, achieving arbitrary code execution in the user's security context. The local attack vector reflects the requirement that the crafted file be opened directly by the victim.

Root Cause

The root cause is improper validation of size or length values during file parsing. When a malformed value is subtracted from a smaller value without bounds checking, the result wraps around. Subsequent allocation or copy operations use this corrupted value, producing exploitable memory corruption.

Attack Vector

An attacker crafts a malicious 3D project or asset file that triggers the underflow when parsed by Substance 3D Stager. The file is delivered through email, shared cloud storage, or a compromised asset marketplace. Once opened, the embedded payload executes with the privileges of the current user. No network exposure is required, and authentication is not needed because exploitation occurs at the application layer.

No public proof-of-concept exploit is currently available, and the EPSS score remains low.

No verified exploitation code is published. See the Adobe Security Patch APSB25-113 advisory for vendor technical details.

Detection Methods for CVE-2025-61835

Indicators of Compromise

Unexpected child processes spawned by Adobe Substance 3D Stager.exe on Windows or the Stager bundle on macOS
Substance 3D Stager loading project files from unusual paths such as temporary directories, email attachment folders, or browser download locations
Crash dumps or Windows Error Reporting events referencing Substance 3D Stager modules immediately preceding suspicious process activity

Detection Strategies

Monitor process lineage for Substance 3D Stager spawning shells, scripting engines (powershell.exe, cmd.exe, bash, osascript), or LOLBins
Alert on Substance 3D Stager writing executable content to user-writable paths followed by execution of those files
Correlate file-open events for .ssa, .sbs, or other Stager project formats with subsequent anomalous network connections

Monitoring Recommendations

Track Substance 3D Stager version inventory across endpoints and flag any host still running 3.1.5 or earlier
Enable application crash telemetry collection on workstations used by 3D and creative teams
Review email gateway and cloud storage logs for inbound 3D asset files originating from untrusted senders

How to Mitigate CVE-2025-61835

Immediate Actions Required

Upgrade Substance 3D Stager to the fixed version identified in Adobe bulletin APSB25-113 on all Windows and macOS endpoints
Restrict opening of Substance 3D Stager project files received from external or untrusted sources until patching is complete
Communicate the risk to creative and design teams who regularly exchange 3D assets

Patch Information

Adobe addressed CVE-2025-61835 in the security update referenced by bulletin APSB25-113. Administrators should consult the Adobe Security Patch APSB25-113 advisory for the exact fixed version and deployment instructions for both Windows and macOS.

Workarounds

Do not open Substance 3D Stager files from unknown or unverified sources until the patch is applied
Run Substance 3D Stager under a standard user account with no administrative privileges to limit impact of arbitrary code execution
Apply application allowlisting policies that prevent Substance 3D Stager from launching unauthorized child processes

bash

# Example: enumerate Substance 3D Stager versions across Windows endpoints via PowerShell
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -like 'Adobe Substance 3D Stager*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation