CVE-2025-54191
📋 TL;DR
Substance3D Painter versions 11.0.2 and earlier contain an out-of-bounds read vulnerability that could allow attackers to read sensitive memory contents. Users who open malicious files with affected versions are vulnerable to potential information disclosure. This requires user interaction through opening a malicious file.
💻 Affected Systems
- Adobe Substance3D Painter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive memory contents including passwords, encryption keys, or other application data could be disclosed to an attacker.
Likely Case
Limited memory disclosure that could aid in further exploitation or reveal application-specific data.
If Mitigated
No impact if users only open trusted files or have patched versions.
🎯 Exploit Status
Requires user interaction (opening malicious file) and knowledge of file format manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.3 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_painter/apsb25-77.html
Restart Required: No
Instructions:
1. Open Substance3D Painter. 2. Go to Help > Check for Updates. 3. Follow prompts to install version 11.0.3 or later. 4. Alternatively, download latest version from Adobe Creative Cloud.
🔧 Temporary Workarounds
Restrict file opening
allOnly open Substance3D Painter files from trusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized files
- Educate users to only open Substance3D Painter files from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check Substance3D Painter version in Help > About Substance3D Painter. If version is 11.0.2 or earlier, system is vulnerable.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 11.0.3 or later in Help > About Substance3D Painter.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening files
- Unusual memory access patterns in application logs
Network Indicators:
- Downloads of Substance3D Painter files from untrusted sources
SIEM Query:
EventID=4688 AND ProcessName LIKE '%Painter%' AND CommandLine LIKE '%.spp%'