Substance 3D Stager CVE-2025-61806

Exploitation requires that a victim running Adobe Substance 3D Stager (version 3.1.4 or earlier) locally open an attacker-crafted malicious file; the out-of-bounds read is triggered specifically during the parsing of that crafted file. Key limiting factors: the attack is local (AV:L) and cannot be triggered remotely without user action - it depends entirely on social engineering to deliver and have the victim open the file (UI:R), and resulting code execution is confined to the privileges of the current user (S:U), not SYSTEM/root. There is no network-facing or unauthenticated-service exposure.

This is a moderate-priority, not a drop-everything, issue. The CVSS 3.1 base score of 7.8 is driven entirely by local attack vector (AV:L) with low complexity and no privileges, but gated by required user interaction (UI:R): a victim must open an attacker-supplied malicious file. The claimed impact (C:H/I:H/A:H) reflects Adobe's position that the out-of-bounds read (CWE-125) can be leveraged to execute code in the current user's context, though the described primitive is fundamentally a memory read-past-end, so reliable code execution is plausible but not guaranteed and would typically require additional exploitation effort. Exploitation signals are weak: EPSS is only 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit code was identified - the vulnerability is not under known active exploitation. The signals are internally consistent (local, user-interaction-dependent file-parsing bug with low mass-exploitation probability), with no major conflicts; the only tension worth noting is that a pure out-of-bounds READ (CWE-125) maps less naturally to full I:H/A:H code-execution impact than the vendor rating implies - verify the exact exploitation primitive with Adobe if precise impact matters. Overall this behaves like a typical client-side file-parsing flaw: real but requiring social engineering, best handled via normal patch cycles rather than emergency response.

An attacker crafts a malicious 3D scene or asset file and delivers it to a victim via email, a shared project, or a download, relying on social engineering to get them to open it in Substance 3D Stager. When Stager parses the crafted file, an out-of-bounds read occurs in the parsing logic, which the attacker leverages to execute code in the context of the current user. No public proof-of-concept or exploit code was identified at time of analysis.