CVE-2025-43571
📋 TL;DR
CVE-2025-43571 is a use-after-free vulnerability in Substance3D Stager that could allow arbitrary code execution when a user opens a malicious file. This affects users of Substance3D Stager versions 3.1.1 and earlier, allowing attackers to run code with the victim's privileges.
💻 Affected Systems
- Adobe Substance3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation leading to user account compromise, data exfiltration, or lateral movement within the network.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only affecting isolated user data.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and understanding of use-after-free memory corruption techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.2 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb25-46.html
Restart Required: Yes
Instructions:
1. Open Substance3D Stager. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Restart the application. 5. Verify version is 3.1.2 or higher.
🔧 Temporary Workarounds
Restrict file opening
allPrevent users from opening untrusted .stg or other Substance3D files from unknown sources
Application sandboxing
allRun Substance3D Stager in restricted environments or sandboxes to limit potential damage
🧯 If You Can't Patch
- Implement application control policies to restrict Substance3D Stager execution to trusted users only
- Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file opening behavior
🔍 How to Verify
Check if Vulnerable:
Check Substance3D Stager version in application settings or About dialog. If version is 3.1.1 or earlier, system is vulnerable.Check Version:
On Windows: Check Help > About in Substance3D Stager GUI. No direct command-line version check available.Verify Fix Applied:
Verify version is 3.1.2 or later in application settings. Test opening known safe files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected child processes spawned from Substance3D Stager
- Suspicious file opening events from the application
Network Indicators:
- Unexpected outbound connections from Substance3D Stager process
- DNS requests to suspicious domains after file opening
SIEM Query:
process_name:"Substance3D Stager.exe" AND (event_type:crash OR child_process_name:suspicious)