Substance 3D Stager CVE-2025-61807

Exploitation requires that a victim user manually open an attacker-supplied malicious file in Adobe Substance 3D Stager version 3.1.4 or earlier; it cannot be triggered remotely or without user action. The CVSS vector (AV:L/UI:R) confirms a local attack vector with mandatory user interaction, which is the primary limiting factor - there is no network-facing service, no autonomous or wormable path, and code execution is confined to the privileges of the current user (S:U, no privilege escalation). While PR:N means no prior authentication to the application is needed, the social-engineering step of inducing the victim to open a crafted file is the practical gating condition, and resulting access is bounded by that user's OS-level permissions.

Severity is driven by high technical impact (C:H/I:H/A:H) enabling arbitrary code execution, but all exploitation-likelihood signals point to low real-world urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a LOCAL, file-based attack requiring the victim to open a malicious file - not a remotely reachable network service - so the 7.8 'HIGH' base score overstates the autonomy of exploitation. EPSS reinforces this: 0.21% probability at only the 10th percentile indicates the model sees very low likelihood of exploitation in the next 30 days. The CVE is NOT on CISA KEV and no public exploit code was provided, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Net assessment: this is a legitimate code-execution flaw that should be patched, but it is a client-side, user-interaction-gated issue in a specialized desktop tool rather than a mass-exploitation priority - closer to a 'high-CVSS, moderate-real-risk' bug. Signals are internally consistent (local vector + UI requirement + low EPSS all agree); no conflicts to flag beyond the usual caveat that base CVSS does not discount for the required user interaction.

An attacker crafts a malicious 3D project or asset file that triggers the integer overflow (CWE-190) during parsing in Substance 3D Stager, then distributes it via email, a shared asset marketplace, or a collaboration channel. When a 3D artist opens the file in a vulnerable version (≤3.1.4), the overflow corrupts memory and leads to arbitrary code execution in the context of that user. No public exploit code has been identified at time of analysis, so exploitation would currently require independent development of a working payload.