CVE-2025-54204
📋 TL;DR
Substance3D Modeler versions 1.22.0 and earlier contain an out-of-bounds read vulnerability that could allow attackers to read sensitive memory contents. Users who open malicious files with affected versions are vulnerable to potential information disclosure.
💻 Affected Systems
- Adobe Substance3D Modeler
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive memory contents including credentials, encryption keys, or other application data could be exfiltrated to an attacker.
Likely Case
Limited memory disclosure that could reveal application state or user data, potentially enabling further attacks.
If Mitigated
No impact if users avoid opening untrusted files or have patched to version 1.22.1 or later.
🎯 Exploit Status
Requires user to open a specially crafted malicious file. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.22.1 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html
Restart Required: No
Instructions:
1. Open Substance3D Modeler. 2. Go to Help > Check for Updates. 3. Install version 1.22.1 or later. 4. Verify installation by checking version in About dialog.
🔧 Temporary Workarounds
Restrict file opening
allOnly open trusted .sbsar, .sbs, and other Substance3D files from verified sources.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of older vulnerable versions
- Educate users to avoid opening untrusted 3D model files and use file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Open Substance3D Modeler, go to Help > About, check if version is 1.22.0 or earlier.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Confirm version is 1.22.1 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crash logs with memory access violations
- Unexpected file processing errors
Network Indicators:
- Outbound connections after opening 3D model files from untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="Substance3D Modeler.exe" AND Description CONTAINS "access violation"