What is the CVSS score of CVE-2025-61805?

CVE-2025-61805 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2025-61805?

Within 24 hours, verify whether Adobe Substance 3D Stager 3.1.4 or earlier is deployed in your environment and instruct users not to open untrusted 3D asset files; consider temporarily restricting use of the application for high-risk tasks. Within 7 days, implement application isolation or sandboxing for Substance 3D Stager, ensure users operate with least privilege, and deploy email and web filtering to block malicious 3D asset files. Within 30 days, monitor Adobe's advisory for a patch, and once released, apply it immediately; in the meantime, conduct user awareness training on the risks of opening files from unknown sources.

Substance 3D Stager CVE-2025-61805

HIGH

Out-of-bounds Read (CWE-125)

2025-10-14 psirt@adobe.com

Buffer Overflow Information Disclosure Substance 3d Stager

7.8

CVSS 3.1 · Vendor: adobe

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Deliver crafted 3D asset file to victim
Exploit

Victim opens file in Substance 3D Stager
Execution

Parser reads past allocated buffer (CWE-125)
Impact

Execute code as current user

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that a victim user open an attacker-crafted file in Adobe Substance 3D Stager (version 3.1.4 or earlier); the malformed file triggers an out-of-bounds read in the file parser. Key limiting factors: the attack is local (AV:L) and cannot be triggered remotely without user action - the victim must actively open the malicious file (UI:R) - and code executes only with the privileges of that user, not elevated. There is no network-facing or unauthenticated path; the primary barrier is social-engineering the victim into opening an untrusted 3D asset file.
Impact	This is a genuine but not emergency-grade issue. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H is local (AV:L) and requires user interaction (UI:R) - meaning exploitation is not remote-automatable but depends on a victim opening a crafted file. The 7.8 base score is driven by the C:H/I:H/A:H impact (arbitrary code execution in the current user's context), not by ease of delivery. Corroborating signals point toward LOW real-world urgency: EPSS is only 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit (POC) has been identified. The SSVC-style read is 'exploitation: none, automatable: no (user must open a file), technical impact: total.' No signals conflict - the low EPSS, absence of KEV, and UI:R requirement all align with a file-format parsing bug that is dangerous if triggered but not being exploited at scale. Note a minor data caveat: the input cites reference APSB25-104 while the CVE year is 2025; treat the specific Adobe bulletin ID as needing verification against Adobe's advisory index. Overall: patch in normal cycle, prioritize for users who routinely open untrusted 3D asset files.
Exploit ScenarioDerived	An attacker crafts a malicious 3D asset/scene file and delivers it to a victim (e.g., via email, a shared project, or a download), relying on the victim opening it in Substance 3D Stager 3.1.4 or earlier. When the application parses the file, an out-of-bounds read past an allocated memory structure is triggered, which the attacker leverages to execute code in the context of the current user. No public exploit code has been identified at time of analysis, and successful attack hinges on user interaction (opening the file).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

An out-of-bounds read in Adobe Substance 3D Stager 3.1.4 and earlier allows a crafted 3D asset file to cause the parser to read past the end of an allocated memory structure, which Adobe rates as potential code execution in the context of the current user (CVSS 7.8, CWE-125). The attack is local rather than network-facing and requires the victim to actively open a malicious file, so the practical barrier is convincing a user to import an untrusted asset; exploitation runs only with that user's privileges, not elevated rights. No public exploit code has been identified at time of analysis and EPSS is low at 0.21% (10th percentile), which is consistent with a genuine but not emergency-grade issue.

RemediationAI

Update Substance 3D Stager to the fixed build documented in Adobe security bulletin APSB25-104 (https://helpx.adobe.com/security/products/substance3d_stager/apsb25-104.html); the provided data does not include an exact fix version number, so verify the patched version in that advisory before certifying a host as remediated, and apply it through Creative Cloud/Adobe's updater or the installer package. Until then, treat the exposed surface as the file parser and compensate accordingly: block or quarantine 3D asset and scene files arriving from untrusted sources at the email gateway and web proxy so users cannot easily open them (trade-off: this breaks legitimate asset-sharing and interchange workflows for artists), enforce a policy of opening only assets from known-good libraries, and run Stager under a standard, non-administrative account or inside a sandboxed/VM workstation so that any code execution inherits only that low-privilege context (trade-off: reduced GPU acceleration and hardware integration in virtualized environments). Because exploitation requires user interaction rather than a remote service, EDR detections focused on anomalous child processes, unexpected network connections, or memory-corruption crashes originating from the Stager process are a useful secondary alarm; note that none of these controls eliminate the underlying parser defect, and the vendor patch remains the only complete fix.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a classic CWE-125 out-of-bounds read in the file-parsing path of Adobe Substance 3D Stager, the material and scene staging application in the Substance 3D line. When the application parses a malformed asset file, it follows length or offset fields derived from the file without adequately validating them, reading past the end of an allocated memory structure; Adobe's bulletin and the affected CPE entry (cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:*) identify all releases up to and including 3.1.4. Although CWE-125 is usually associated with information disclosure or crashes, the CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector assigns high confidentiality, integrity and availability impact, meaning the mis-parse is assessed as reaching a state that can be leveraged for code execution in the current user's context. The vector also confirms the preconditions seen in practice: local attack path (AV:L), no privileges required (PR:N) but required user interaction (UI:R), so there is no unauthenticated or remote-triggerable route into the parser.

Know when Substance 3d Stager gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (adobe) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

File must be opened locally by the user so AV:L and UI:R; no prior privileges needed (PR:N); parsing bug yields code execution in user context, giving full C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Substance3D - Stager versions 3.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Executive ViewAI

Why It Matters

Adobe Substance 3D Stager, a 3D design application used by creative teams, contains a high-severity vulnerability that could allow an attacker to execute code with the privileges of the user who opens a malicious 3D asset file. While no public exploit code has been identified and exploitation requires local user interaction, a successful attack could compromise sensitive data or enable further intrusion within the user's environment. Leadership should ensure that affected teams are aware of the risk and that interim mitigations are implemented until Adobe provides a patch.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: avoid opening untrusted 3D asset files, run the application with least privileges, use application sandboxing, and implement user awareness training.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Low

niche professional 3D staging/rendering tool, limited to design workflows

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.