Substance 3D Viewer CVE-2025-54275

Exploitation requires the victim to locally open an attacker-crafted malicious file in Adobe Substance 3D Viewer version 0.25.2 or earlier; this is reflected in the vector's AV:L (local, file-based) and UI:R (required user interaction). There is no remote or unauthenticated network path and no privileged access needed on the attacker side, but the mandatory victim action of opening a malicious file is the primary limiting factor, as is the restriction to vulnerable versions 0.25.2 and earlier. Impact is bounded to availability (application denial-of-service) with no confidentiality or integrity effect.

This is a genuinely moderate-to-low priority issue despite being a memory-corruption bug. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) is internally consistent with the description: it is a local, file-borne vulnerability requiring a victim to open a malicious file, with impact limited strictly to availability (application crash/DoS) and no confidentiality or integrity loss. Although CWE-787 (out-of-bounds write) and the 'Buffer Overflow'/'Memory Corruption' tags often hint at potential code execution, both Adobe's description and the CVSS impact metrics (C:N/I:N) constrain the realistic outcome to denial-of-service only - there is no indication of RCE in the provided data. Exploitation signals are weak and mutually consistent: EPSS is 0.16% (4th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced - no public exploit identified at time of analysis. The low EPSS aligns with the local, user-interaction-dependent vector, so this is a high-CVSS-relative-to-real-risk picture tilted toward low operational urgency. No signals conflict; the main uncertainty is whether the out-of-bounds write could be developed into something beyond DoS, which the available data does not support claiming.

An attacker crafts a malicious 3D model or scene file and distributes it (e.g., via email, a shared asset library, or a download) to a user of Adobe Substance 3D Viewer. When the victim opens the file in a vulnerable version (0.25.2 or earlier), the out-of-bounds write is triggered and the application crashes, denying availability. No public exploit code is referenced, and exploitation depends on convincing the victim to open the attacker-supplied file locally.