Substance 3D Viewer
CVE-2025-54274
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D file to victim
-
ExploitVictim opens file in Substance 3D Viewer
-
ExecutionTrigger stack-based buffer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Substance 3D Viewer (version 0.25.2 or earlier); per the CVSS vector this is local (AV:L) with required user interaction (UI:R) and no authentication (PR:N). The decisive limiting factors are the mandatory user action of opening the crafted file and the local attack vector - there is no network-triggerable path and no privilege escalation beyond the current user's context (S:U). Risk is therefore concentrated on workstations where users routinely import untrusted 3D assets; environments that only consume trusted, internally-produced files have materially lower exposure. |
| Impact | This is a genuine but not emergency-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes local, user-interaction-dependent code execution rather than remote compromise - the AV:L plus UI:R combination means an attacker cannot reach the flaw over a network and cannot act without a victim manually opening a crafted file. All exploitation signals align toward lower real-world urgency: EPSS is only 0.24% (14th percentile), the CVE is NOT in CISA KEV, and no public exploit code was identified in the provided data. There is no SSVC decision record in the input to corroborate automatable/exploitation status. The signals are internally consistent (high technical impact but constrained delivery), so there is no contradiction to flag; the gap between the HIGH CVSS and the low EPSS is expected for a client-side file-parsing bug that depends on social engineering. Net: patch during normal cycles, prioritize for users who routinely open untrusted 3D asset files. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D model/scene file and delivers it to a victim via email, a shared asset repository, or a download, relying on the victim to open it in Substance 3D Viewer 0.25.2 or earlier. Parsing the file triggers a stack-based buffer overflow (CWE-121) that executes arbitrary code in the context of the current user. No public proof-of-concept was identified at time of analysis, so weaponization effort would fall on the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Opening an attacker-supplied asset file in Adobe Substance 3D Viewer 0.25.2 or earlier can trigger a stack-based buffer overflow that lets code execute with the privileges of the current user, as documented in Adobe advisory APSB25-99. Per the CVSS vector the attack is local (AV:L) with required user interaction (UI:R) and no authentication (PR:N); there is no network-triggerable path and no privilege escalation beyond the current user's context (S:U), so exposure is concentrated on workstations where users routinely import untrusted 3D assets. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.24% (14th percentile), making this a genuine but not emergency-priority issue for most environments.
RemediationAI
Update Adobe Substance 3D Viewer to a release newer than 0.25.2 using the fixed build named in Adobe advisory APSB25-99 (https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-99.html) - the supplied data does not specify the exact patched version number, so confirm it against that advisory before closing the finding. Until every workstation is updated, treat all externally sourced 3D assets as untrusted: instruct users not to open files received from outside the organization, and where the workflow permits, gate imports through a sandboxed or low-privilege viewer instance or a network-isolated review host. Additional compensating controls include application allow-listing and EDR/OS-level exploit mitigations (DEP, ASLR, hardened heap/stack protections) on hosts that must keep the older build, plus running the viewer as a non-administrative and ideally low-privilege local account so that any successful exploitation is bounded by that user's rights. The trade-off is operational: file-blocking policies slow legitimate collaborative review, and sandbox/low-privilege execution can break plug-in paths or asset caching, so scope those restrictions to the untrusted-asset workflow rather than to trusted, internally produced content. Because the attack is local and requires the victim to open the crafted file, no network-perimeter control (firewall or port blocking) is an effective mitigation here.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a stack-based buffer overflow (CWE-121) in the file-parsing pipeline of Adobe Substance 3D Viewer, the desktop utility used to preview Substance materials and common 3D asset formats (e.g. .sbsar, .obj, .fbx, .gltf/.glb, USD). A crafted file supplies data whose length is not properly bounded before it is copied onto a fixed-size stack buffer, so the overwrite can corrupt the return address and control flow, yielding arbitrary code execution inside the viewer process. Because the vulnerable code runs in the context of the user who opened the file, impact is confined by the CVSS scope-unchanged rating: confidentiality, integrity and availability are all rated High (C:H/I:H/A:H) but only for that user and their accessible resources. The vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms the trigger is a local file open rather than a network request, that no credentials are needed, and that the decisive precondition is the victim's action of opening the malicious asset. The CPE entry cpe:2.3:a:adobe:substance_3d_viewer:*:*:*:*:*:*:*:* matches the unpatched release line up to and including 0.25.2, with no platform or update qualifiers given in the supplied data. No CVE-to-KEV mapping was provided, and the very low EPSS score is consistent with a targeted, file-based trigger that is unlikely to be mass-exploited.
Know when Substance 3d Viewer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally so AV:L/UI:R; no prior auth needed so PR:N; memory-corruption RCE in the user's context yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Viewer versions 0.25.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Viewer version 0.25.2 and earlier contains a high-severity stack-based buffer overflow that allows an unauthenticated attacker to execute code with the current user's privileges when a user opens a malicious 3D asset file. This vulnerability primarily affects creative workstations where users regularly import untrusted 3D assets, potentially leading to data compromise or lateral movement if a workstation is breached. No public exploit identified at time of analysis, and the EPSS score is low, but the lack of a vendor patch warrants immediate mitigating actions to protect affected users.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting the import of untrusted 3D asset files, enforcing least privilege for users of Adobe Substance 3D Viewer, enabling operating system exploit mitigations, and monitoring for suspicious file execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Substance 3d Viewer
View allOpening a specially crafted file in Adobe Substance 3D Viewer version 0.25.2 and earlier can trigger an out-of-bounds wr
Arbitrary code execution in Adobe Substance 3D Viewer 0.25.2 and earlier can occur when a victim opens a maliciously cra
Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Substance3D - Viewer versions 0.25.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could r
Opening a malicious 3D asset file in Adobe Substance 3D Viewer 0.25.2 and earlier can trigger an out-of-bounds write tha
Substance3D - Viewer versions 0.22 and earlier are affected by an out-of-bounds read vulnerability that could lead to di
Substance3D - Viewer versions 0.22 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead
Substance3D - Viewer versions 0.25.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Viewer versions 0.25.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Viewer versions 0.25 and earlier are affected by an out-of-bounds write vulnerability that could result in
Substance3D - Viewer versions 0.25 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
GitHub PoC
Exploit-DB