Adobe Substance 3D Stager CVE-2025-61802
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious scene file via phishing
-
ExploitVictim opens file in Substance 3D Stager
-
ExecutionTrigger use-after-free in file parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file (e.g., a crafted Substance 3D Stager scene/project asset) in a vulnerable build (version 3.1.4 or earlier); there is no remote or network-triggered path. Limiting factors: mandatory user interaction (file must be opened locally), the Local attack vector, and the resulting code execution being confined to the privileges of the current user (no privilege escalation or scope change). No special product configuration is required beyond running a vulnerable version. |
| Impact | The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a client-side, local attack: despite PR:N (no privileges required), the Local attack vector and UI:R mean an attacker cannot reach this remotely or autonomously - a user must be socially engineered into opening a malicious file. This is corroborated by the description ('requires user interaction in that a victim must open a malicious file'), so the signals are internally consistent and NOT a network-reachable flaw. Real-world risk signals point downward: EPSS is only 0.22% (11th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was identified in the provided data. The combination of required user interaction, local vector, and a niche creative-design product makes this a standard Patch-Tuesday-class desktop RCE rather than an urgent mass-exploitation priority. Note the input references advisory APSB25-104 while the CVE ID is CVE-2025-61802; treat the advisory number (not the earlier-looking ID year) as the authoritative Adobe source and verify the exact fixed version against it. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Stager project/scene file and delivers it via phishing, a shared asset repository, or a compromised download. When the victim opens the file in a vulnerable version (3.1.4 or earlier), the use-after-free is triggered and arbitrary code executes in the context of the current user. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Use-after-free memory corruption in Adobe Substance 3D Stager 3.1.4 and earlier allows an attacker to execute arbitrary code in the context of the current user when a victim opens a maliciously crafted file in the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a client-side, local attack: despite PR:N, the Local vector and required user interaction mean the attacker cannot reach this remotely or autonomously and must socially engineer the victim into opening the file. Exploitation stays within the privileges of the current user with no privilege escalation or scope change, and no public exploit code has been identified at time of analysis (EPSS 0.22%, percentile 11%, indicating low predicted exploitation activity); it is not confirmed actively exploited (CISA KEV).
RemediationAI
Upgrade Adobe Substance 3D Stager to the fixed release described in Adobe security bulletin APSB25-104 (https://helpx.adobe.com/security/products/substance3d_stager/apsb25-104.html) - patch availability is confirmed via the vendor advisory, and the advisory should be consulted for the exact patched build number, since no specific fix version is stated in the supplied data. Because the only attack path is a user opening a malicious file, the most effective compensating controls are procedural: block or strictly scan inbound .stager scene/project and associated Substance asset files from untrusted or external sources before they are opened, and train users not to open unknown project files received by email, chat, or download. Where feasible, run Stager in a sandboxed/virtualized environment or under a low-privilege account; note that this does not prevent exploitation but confines the impact, since code execution is limited to the current user's privileges. There is no network service to firewall off and no configuration toggle provided in the available data, so disabling file associations or restricting who may launch the application is the main hardening option, at the cost of reduced workflow flexibility.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in Adobe Substance 3D Stager, a desktop 3D scene composition and staging tool used to lay out, light, and render product and material scenes. CWE-416 occurs when the application frees a heap object during parsing of an attacker-supplied document - here a crafted Stager scene/project or associated Substance asset - but continues to dereference a stale pointer to that freed memory. Because the dangling pointer is reused for attacker-influenced data, the corruption can be shaped into controlled memory writes that are ultimately leveraged for arbitrary code execution within the process. The NVD CPE entry cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:* identifies the affected component family as the Stager application across its vulnerable release line (3.1.4 and earlier), and the disclosed attack surface is the local file-open path rather than any network service. The associated tags (RCE, Use After Free, Memory Corruption, Denial Of Service) are consistent with the CWE-416 root cause: depending on heap layout, the same primitive can also crash the application, giving a denial-of-service outcome in addition to code execution.
Know when Substance 3d Stager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open use-after-free: AV:L and UI:R because the victim must locally open a malicious file; PR:N as no attacker auth is needed; C/I/A:H for arbitrary code execution as the current user.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager versions 3.1.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
A memory-corruption flaw in Adobe Substance 3D Stager 3.1.4 and earlier could let a crafted 3D file run attacker-controlled code on the workstation of whoever opens it, exposing that employee's files, credentials, and network access. The risk is concentrated in 3D design and content teams rather than across the enterprise, and it depends on someone being tricked into opening a malicious asset, so it is a targeted social-engineering risk rather than a broad automated one. Because Adobe has not yet shipped a fix, leadership should treat this as an open exposure requiring interim controls and asset inventory rather than a one-time patch task.
No vendor-released patch identified at time of analysis. Interim mitigations: block or quarantine untrusted 3D asset files (.stg, .obj, .fbx and similar) at email, web, and collaboration gateways; enforce least privilege to prevent local administrator rights on affected workstations; restrict use of Substance 3D Stager to trusted internal asset libraries only; enable and monitor endpoint detection and response on all hosts running the product; and apply vendor patch immediately once Adobe publishes it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Substance 3d Stager
View allArbitrary code execution in Adobe Substance 3D Stager 3.1.4 and earlier is possible when a victim opens a specially craf
Out-of-bounds read in Adobe Substance 3D Stager 3.1.4 and earlier is triggered while parsing a crafted file, letting an
An out-of-bounds read in Adobe Substance 3D Stager 3.1.4 and earlier allows a crafted 3D asset file to cause the parser
Arbitrary code execution in the context of the current user is possible in Adobe Substance 3D Stager 3.1.4 and earlier w
Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbi
Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbi
Arbitrary code execution in Substance 3D Stager 3.1.5 and earlier stems from a use-after-free vulnerability that execute
Arbitrary code execution in Substance 3D Stager 3.1.6 and earlier via an out-of-bounds write vulnerability allows local
Arbitrary code execution in Substance 3D Stager 3.1.7 and earlier through a use-after-free memory vulnerability that tri
Arbitrary code execution in Substance 3D Stager 3.1.7 and earlier stems from a use-after-free vulnerability that execute
Code execution in Substance 3D Stager 3.1.6 and earlier through a crafted file that triggers an out-of-bounds memory rea
Substance 3D Stager 3.1.6 and earlier contains an out-of-bounds read vulnerability in file parsing that allows arbitrary
GitHub PoC
Exploit-DB