CVE-2025-54243 – CVE-2025-54243 is an out-of-bounds write vulner... (How to Fix)

Q: What is the severity of CVE-2025-54243?

CVE-2025-54243 has a CVSS score of 7.8 (HIGH). CVE-2025-54243 is an out-of-bounds write vulnerability in Substance3D Viewer that could allow arbitrary code execution when a user opens a malicious file. This affects users of Substance3D Viewer versions 0.25.1 and earlier, requiring user interaction to trigger the exploit.

📋 TL;DR

CVE-2025-54243 is an out-of-bounds write vulnerability in Substance3D Viewer that could allow arbitrary code execution when a user opens a malicious file. This affects users of Substance3D Viewer versions 0.25.1 and earlier, requiring user interaction to trigger the exploit.

💻 Affected Systems

Products:

Adobe Substance3D Viewer

Versions: 0.25.1 and earlier

Operating Systems: Windows, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: All installations of affected versions are vulnerable by default when opening Substance3D files.

📦 What is this software?

Substance 3d Viewer by Adobe

View all CVEs affecting Substance 3d Viewer →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with attacker gaining full control of the user's system in the context of the current user account.

🟠

Likely Case

Malware installation, data theft, or ransomware deployment after a user opens a malicious Substance3D file.

🟢

If Mitigated

Limited impact if users only open trusted files from verified sources and have proper endpoint protection.

🌐 Internet-Facing: LOW - Exploitation requires user interaction with malicious files, not direct network exposure.

🏢 Internal Only: MEDIUM - Internal users could be targeted via phishing or shared malicious files, but still requires user interaction.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires user interaction (opening malicious file) and knowledge of file format manipulation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.25.2 or later

Vendor Advisory: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-89.html

Restart Required: Yes

Instructions:

1. Open Substance3D Viewer. 2. Go to Help > Check for Updates. 3. Follow prompts to install version 0.25.2 or later. 4. Restart the application.

🔧 Temporary Workarounds

Disable automatic file opening

all

Configure system to not automatically open Substance3D files and require explicit user action

Use application sandboxing

all

Run Substance3D Viewer in a sandboxed environment to limit potential damage

🧯 If You Can't Patch

Restrict user permissions to limit potential damage from code execution
Implement application whitelisting to prevent unauthorized execution

🔍 How to Verify

Check if Vulnerable:

Check Substance3D Viewer version in application settings or About dialog

Check Version:

Not applicable - check via application GUI

Verify Fix Applied:

Verify version is 0.25.2 or later in application settings

📡 Detection & Monitoring

Log Indicators:

Unexpected crashes of Substance3D Viewer
Unusual file access patterns from Substance3D Viewer process

Network Indicators:

Outbound connections from Substance3D Viewer to unexpected destinations

SIEM Query:

process_name:"Substance3D Viewer" AND (event_type:crash OR outbound_connection:unusual)

📊 Metadata

CVE ID: CVE-2025-54243

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-787

EPSS Score: 0.02% exploit probability (5th percentile)

Published: September 9, 2025

Last Updated: September 12, 2025

🔗 References

https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-89.html Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-54243, you might also want to check these: