Substance 3D Viewer CVE-2025-54273

Exploitation requires the victim to open a maliciously crafted file in Adobe Substance 3D Viewer (version 0.25.2 or earlier) - this is the explicit, mandatory user-interaction gate (UI:R) and the primary limiting factor, meaning there is no remote or zero-click path. The attack vector is local (AV:L): the malicious file must reach and be opened on the target host. No authentication or elevated privileges are needed (PR:N), and attack complexity is low (AC:L), but the dependence on social engineering to induce file-opening substantially constrains realistic exploitation compared to a network-facing service flaw.

This is a genuine arbitrary-code-execution flaw (CWE-787 out-of-bounds write) in Adobe Substance 3D Viewer, but the combined signals point to moderate real-world priority rather than an emergency. The CVSS vector (AV:L, AC:L, PR:N, UI:R, S:U, C:H/I:H/A:H, base 7.8) describes a local, low-complexity, unauthenticated attack that nevertheless requires the victim to open a malicious file - so it is not remotely wormable. EPSS reinforces this: 0.19% probability at the 8th percentile indicates very low likelihood of observed exploitation. There is no CISA KEV listing and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. The signals are consistent (low EPSS, no KEV, no POC, user-interaction requirement all point the same direction), so this is best treated as a standard patch-cycle item for environments that actually run Substance 3D Viewer, prioritized above cosmetic bugs because successful exploitation yields full code execution in the user's context, but not warranting out-of-band emergency response absent evidence of active targeting.

An attacker crafts a malicious 3D asset or project file that triggers the out-of-bounds write when parsed, then delivers it to a target via email, a shared asset library, or a compromised download, relying on social engineering to get the victim to open it in Substance 3D Viewer. When the file is opened, the memory corruption is leveraged to execute arbitrary code in the context of the current user. No public exploit code was identified in the provided data.