CVE-2025-54235
📋 TL;DR
Substance3D Modeler versions 1.22.0 and earlier contain an out-of-bounds read vulnerability that could allow attackers to read sensitive memory contents. Users who open malicious files with affected versions are vulnerable to potential information disclosure.
💻 Affected Systems
- Adobe Substance3D Modeler
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive application memory containing credentials, encryption keys, or other confidential data could be exfiltrated to an attacker.
Likely Case
Limited memory disclosure that might reveal application state or non-critical data, potentially enabling further attacks.
If Mitigated
No impact if users only open trusted files or have patched to version 1.22.1 or later.
🎯 Exploit Status
Requires user interaction (opening malicious file) and knowledge of file format manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.22.1 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html
Restart Required: No
Instructions:
1. Open Substance3D Modeler. 2. Go to Help > Check for Updates. 3. Follow prompts to install version 1.22.1 or later. 4. Verify installation by checking version in About dialog.
🔧 Temporary Workarounds
Restrict file sources
allOnly open Substance3D Modeler files from trusted sources and avoid opening files from unknown origins.
🧯 If You Can't Patch
- Implement application control to restrict execution of Substance3D Modeler to specific trusted users.
- Use network segmentation to isolate systems running vulnerable versions from sensitive networks.
🔍 How to Verify
Check if Vulnerable:
Open Substance3D Modeler, go to Help > About Substance3D Modeler, check if version is 1.22.0 or earlier.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 1.22.1 or later in Help > About Substance3D Modeler dialog.📡 Detection & Monitoring
Log Indicators:
- Application crash logs with memory access violations
- Unexpected file opening events from untrusted sources
Network Indicators:
- Outbound connections following file opening from untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND SourceName='Substance3D Modeler' AND (Description contains 'access violation' OR Description contains 'out of bounds')