CVE-2025-21170
📋 TL;DR
Substance3D Modeler versions 1.15.0 and earlier contain a NULL pointer dereference vulnerability that allows attackers to crash the application by tricking users into opening malicious files. This creates a denial-of-service condition where the software becomes unavailable. Users of affected Substance3D Modeler versions are vulnerable.
💻 Affected Systems
- Adobe Substance3D Modeler
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to denial-of-service, potential data loss if unsaved work is open, and disruption to 3D modeling workflows.
Likely Case
Application crash when opening malicious files, requiring restart and potential loss of unsaved work.
If Mitigated
No impact if users avoid opening untrusted files or have patched to version 1.15.1 or later.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No authentication bypass needed as users already have file access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.15.1 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-21.html
Restart Required: Yes
Instructions:
1. Open Substance3D Modeler. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Restart the application.
🔧 Temporary Workarounds
Restrict file opening
allOnly open files from trusted sources and avoid opening unknown .sbs or .sbsar files.
User awareness training
allEducate users about the risks of opening untrusted files in Substance3D Modeler.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized files
- Use file integrity monitoring to detect suspicious file modifications
🔍 How to Verify
Check if Vulnerable:
Check Substance3D Modeler version in Help > About. If version is 1.15.0 or earlier, system is vulnerable.Check Version:
Not applicable - check version through application GUI Help > About menuVerify Fix Applied:
Verify version is 1.15.1 or later in Help > About after applying update.📡 Detection & Monitoring
Log Indicators:
- Application crash logs with NULL pointer dereference errors
- Unexpected application termination events
Network Indicators:
- No network indicators - local file-based exploit
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="Substance3D Modeler" AND ExceptionCode=0xc0000005