Substance 3D Stager
CVE-2025-61803
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D file to victim
-
ExploitVictim opens file in Stager
-
ExecutionTrigger integer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open an attacker-supplied malicious file in Adobe Substance 3D Stager version 3.1.4 or earlier; there is no remote, unauthenticated, or zero-click path. The integer overflow is reached through the application's file-parsing logic, so the specific limiting factors are: (1) mandatory user interaction (opening/importing the crafted file), (2) local delivery of the file to the target, and (3) the target running an unpatched version. Code execution is confined to the privileges of the current user, so an attacker gains no elevation beyond that account. These constraints make successful exploitation dependent on social engineering rather than direct network reachability. |
| Impact | Multiple signals converge on this being a genuine-but-moderate priority rather than an urgent threat. The CVSS 3.1 base score of 7.8 (HIGH) is driven by HIGH confidentiality, integrity and availability impact (C:H/I:H/A:H) combined with low attack complexity and no required privileges (AC:L/PR:N). However, the attack vector is LOCAL (AV:L) and requires user interaction (UI:R) - this is not a remotely reachable network flaw but a client-side file-parsing bug where a victim must open a malicious file, which materially lowers real-world exploitability. The EPSS score of 0.21% (10th percentile) corroborates low near-term exploitation likelihood. The CVE is NOT listed in CISA KEV and no public proof-of-concept was identified in the provided data, so there is no evidence of active exploitation. These signals are mutually consistent (low EPSS, no KEV, no POC, local+UI-gated vector), so there is no conflict to flag. Net assessment: a legitimately severe code-execution bug in impact terms, but gated behind local access and social-engineering (file delivery), making it a patch-in-normal-cadence item rather than an emergency, especially given the product's limited deployment footprint. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D project/scene file that triggers the integer overflow (CWE-190) in Substance 3D Stager's file parser and delivers it to a target 3D artist or designer via email, a shared asset repository, or a download. When the victim opens the file in a vulnerable version (3.1.4 or earlier), the overflow leads to memory corruption and arbitrary code execution in the context of the current user. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Arbitrary code execution in the context of the current user is possible in Adobe Substance 3D Stager 3.1.4 and earlier when a victim opens a specially crafted file, because an integer overflow or wraparound (CWE-190) in the application's file-parsing logic can corrupt memory. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) confirms that no prior authentication is needed but that exploitation is local to the file path and depends on user interaction, so an attacker must deliver a malicious file to the target and convince the user to open it; impact is confined to the privileges of the running user. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is 0.21% (10th percentile), so this reads as a genuine but moderate-priority patching item rather than an urgent threat.
RemediationAI
Patch status: Patch available per vendor advisory. The primary fix is to update Adobe Substance 3D Stager to the patched release documented in Adobe advisory APSB25-104 (https://helpx.adobe.com/security/products/substance3d_stager/apsb25-104.html); because the supplied data does not state an exact fix version, administrators should pull the current version offered through Creative Cloud or Adobe's download page and confirm the installed build is above the vulnerable 3.1.4 ceiling. Where immediate updating is not possible, actionable compensating controls include: block or quarantine inbound email and web attachments of Substance/3D asset file types so users cannot receive the crafted input (trade-off: legitimate 3D assets shared by mail are also dropped, and users may route around it via cloud storage links); apply Mark-of-the-Web/SmartScreen so downloaded files trigger an extra warning before opening (trade-off: only advisory, users can click through); run Stager as a non-administrative, low-privilege account so code execution cannot inherit elevated rights (trade-off: some licensed features and plugin paths may require reconfiguration); and enable EDR behavioural monitoring for Stager spawning child processes such as script interpreters or shells (trade-off: additional alerting noise and tuning for legitimate rendering workflows). Restricting who may install or run Stager to users who actually need it reduces exposure surface. Note that EPSS is 0.21% (10th percentile), there is no KEV listing, and no public exploit code was identified at time of analysis, so remediation can follow a normal patch cycle rather than an emergency response.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190, an integer overflow or wraparound, reached through Adobe Substance 3D Stager's parsing of attacker-supplied project/asset files. In this class of bug, an arithmetic operation on a size, offset, or length field taken from the file is performed without adequate bounds checking; when the computed value wraps, a resulting buffer allocation or copy is sized incorrectly, allowing out-of-bounds writes that an attacker can shape into controlled memory corruption and, ultimately, arbitrary code execution in the process's security context. The affected component is the desktop Substance 3D Stager application, identified by the CPE cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:* (all versions, no OS qualifier), with versions 3.1.4 and earlier impacted per Adobe's advisory. Because the vulnerable surface is a local file parser rather than a network service, the attack does not require reachability to a listening port; the delivery mechanism is the malicious file itself, which the user must open. Per the CVSS vector, PR:N indicates no authentication is required for the attack itself, while AV:L and UI:R make clear that the exploitation path is local file handling driven by user interaction, and the unchanged scope (S:U) means the compromise does not by itself escape the current user's privileges.
Know when Substance 3d Stager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user, so AV:L and UI:R; no prior privileges needed (PR:N), and memory-corruption code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager versions 3.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager, a 3D design application used by creative teams, contains a high-severity memory corruption vulnerability that could allow an attacker to execute code on a user's workstation if they open a malicious file. While no vendor patch is available, organizations should prioritize mitigation to protect sensitive design assets and prevent potential lateral movement.
No vendor-released patch identified at time of analysis. Interim mitigations include application sandboxing, restricting file-opening permissions to trusted sources, enforcing least privilege, and monitoring for suspicious file execution. Consider disabling the application's file preview feature if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Substance 3d Stager
View allUse-after-free memory corruption in Adobe Substance 3D Stager 3.1.4 and earlier allows an attacker to execute arbitrary
Arbitrary code execution in Adobe Substance 3D Stager 3.1.4 and earlier is possible when a victim opens a specially craf
Out-of-bounds read in Adobe Substance 3D Stager 3.1.4 and earlier is triggered while parsing a crafted file, letting an
An out-of-bounds read in Adobe Substance 3D Stager 3.1.4 and earlier allows a crafted 3D asset file to cause the parser
Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbi
Substance3D - Stager versions 3.1.1 and earlier are affected by a Use After Free vulnerability that could result in arbi
Arbitrary code execution in Substance 3D Stager 3.1.5 and earlier stems from a use-after-free vulnerability that execute
Arbitrary code execution in Substance 3D Stager 3.1.6 and earlier via an out-of-bounds write vulnerability allows local
Arbitrary code execution in Substance 3D Stager 3.1.7 and earlier through a use-after-free memory vulnerability that tri
Arbitrary code execution in Substance 3D Stager 3.1.7 and earlier stems from a use-after-free vulnerability that execute
Code execution in Substance 3D Stager 3.1.6 and earlier through a crafted file that triggers an out-of-bounds memory rea
Substance 3D Stager 3.1.6 and earlier contains an out-of-bounds read vulnerability in file parsing that allows arbitrary
GitHub PoC
Exploit-DB