Substance 3D Viewer
CVE-2025-54280
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious crafted file to victim
-
ExploitVictim opens file in Substance 3D Viewer
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Adobe Substance 3D Viewer version 0.25.2 or earlier to open an attacker-supplied malicious file in the application; the out-of-bounds write (CWE-787) is triggered during that file's parsing. Key limiting factors: it is not remotely reachable without this action (CVSS AV:L, UI:R) - there is no network service to attack, and exploitation depends entirely on social-engineering the user into opening the crafted file. Code runs only with the privileges of the current user, not SYSTEM/root. No special non-default configuration is required beyond having the vulnerable version installed. |
| Impact | Signals are consistent and point to a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity, unauthenticated flaw whose sole barrier is required user interaction - the victim must open a malicious file. This is a client-side file-parsing bug, not a remotely reachable service, which the 'AV:L' confirms despite the 'RCE' tag that might otherwise imply network reach. EPSS is low at 0.19% (8th percentile), and there is no CISA KEV listing and no public exploit identified, so there is no evidence of opportunistic or widespread exploitation. The high EPSS/KEV absence aligns with the delivery model: file-open bugs in niche creative software are exploited via targeted social engineering rather than mass scanning, so a low EPSS is expected and does not contradict the HIGH severity. No SSVC decision data was provided in the input. Net: a real memory-corruption RCE worth patching on a normal cycle, but not an actively-exploited, drop-everything issue. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D asset or project file that triggers the out-of-bounds write when parsed and socially engineers a Substance 3D Viewer user (e.g., a 3D artist) into opening it via email, a shared drive, or a compromised asset marketplace. On open, the heap/memory corruption is leveraged to execute arbitrary code in the context of the current user. No public proof-of-concept exploit has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Opening a specially crafted file in Adobe Substance 3D Viewer version 0.25.2 and earlier can trigger an out-of-bounds write (CWE-787) that leads to arbitrary code execution with the privileges of the current user. The flaw is exploitable only through user interaction - a victim must open the malicious file - reflecting a local attack vector (AV:L, UI:R) with no network service exposed, and code execution is confined to the victim's own account rather than SYSTEM or root. No public exploit code has been identified at time of analysis and the issue is not in CISA's KEV catalog; EPSS is very low at 0.19% (8th percentile), so this is a real but not emergency-grade risk that should be handled through routine patching.
RemediationAI
Update Adobe Substance 3D Viewer to the fixed release specified in Adobe security bulletin APSB-25-99 (https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-99.html); the available input data does not name an exact fixed version number, so the patch level should be confirmed against that advisory before deployment. Until the update is applied, the most effective compensating control is simply not to open untrusted or unsolicited Substance/3D files in the viewer - since exploitation requires the victim to open a malicious file and there is no remotely reachable service, blocking attacker-supplied content neutralizes the practical attack path. Where files must be handled, process them in a low-privilege or sandboxed account/VM (this limits but does not eliminate the impact, since the flaw already runs at user privilege), strip or reject unknown/untrusted 3D file types at email and download gateways (trade-off: some legitimate assets will be blocked or require out-of-band transfer), and keep the application and its file handlers updated. No public exploit code has been identified, so emergency mitigations beyond patching and user awareness are not warranted.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds write (CWE-787) in Adobe Substance 3D Viewer, a desktop application used to preview and inspect Substance 3D material and model files. The root cause class - memory corruption from writing past the bounds of an allocated buffer - typically arises when the application parses attacker-controlled file contents (headers, counts, offsets, or embedded arrays) without adequately validating them against the size of the destination buffer. Because the flaw is triggered during file parsing, successful exploitation corrupts adjacent memory and can redirect execution flow, allowing arbitrary code in the context of the current user. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms a local attack vector with low attack complexity, no privileges required, and mandatory user interaction, yielding high confidentiality, integrity, and availability impact confined to the vulnerable component. CPE data identifies the affected product as cpe:2.3:a:adobe:substance_3d_viewer:*:*:*:*:*:*:*:* (Adobe Substance 3D Viewer), and the advisory is tracked as Adobe APSB-25-99.
Know when Substance 3d Viewer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the victim so AV:L and UI:R; no prior auth needed (PR:N); arbitrary code as current user yields full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Viewer (version 0.25.2 and earlier) contains an out-of-bounds write that lets a crafted 3D asset file execute code under the credentials of the designer or artist who opens it. Exploitation requires a user to deliberately open a malicious file and cannot spread across the network, so exposure is contained to individual workstations rather than shared infrastructure - however, a compromised creative workstation can still expose proprietary 3D assets and serve as a foothold for lateral movement. Because no patch exists yet and exploit activity has not been observed, this is a contained but unresolved risk that warrants coordinated action with Adobe rather than emergency escalation.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict use of Substance 3D Viewer to files from trusted internal sources, block or sandbox untrusted 3D asset files at email and web gateways, enforce least-privilege user accounts so code execution stays confined to the victim's profile, enable EDR monitoring for suspicious child processes spawned by the viewer, and consider temporarily disabling the application on endpoints that do not require it until Adobe ships a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Substance 3d Viewer
View allOpening an attacker-supplied asset file in Adobe Substance 3D Viewer 0.25.2 or earlier can trigger a stack-based buffer
Arbitrary code execution in Adobe Substance 3D Viewer 0.25.2 and earlier can occur when a victim opens a maliciously cra
Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Substance3D - Viewer versions 0.25.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could r
Opening a malicious 3D asset file in Adobe Substance 3D Viewer 0.25.2 and earlier can trigger an out-of-bounds write tha
Substance3D - Viewer versions 0.22 and earlier are affected by an out-of-bounds read vulnerability that could lead to di
Substance3D - Viewer versions 0.22 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead
Substance3D - Viewer versions 0.25.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Viewer versions 0.25.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Viewer versions 0.25 and earlier are affected by an out-of-bounds write vulnerability that could result in
Substance3D - Viewer versions 0.25 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
GitHub PoC
Exploit-DB