CVE-2025-54275 – CVE-2025-54275 is an out-of-bounds write vulner... (How to Fix)

Q: What is the severity of CVE-2025-54275?

CVE-2025-54275 has a CVSS score of 5.5 (MEDIUM). CVE-2025-54275 is an out-of-bounds write vulnerability in Substance3D Viewer that allows attackers to cause denial-of-service by crashing the application. Users of Substance3D Viewer versions 0.25.2 and earlier are affected when they open malicious files. This requires user interaction to exploit.

📋 TL;DR

CVE-2025-54275 is an out-of-bounds write vulnerability in Substance3D Viewer that allows attackers to cause denial-of-service by crashing the application. Users of Substance3D Viewer versions 0.25.2 and earlier are affected when they open malicious files. This requires user interaction to exploit.

💻 Affected Systems

Products:

Adobe Substance3D Viewer

Versions: 0.25.2 and earlier

Operating Systems: Windows, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: All default installations of affected versions are vulnerable when processing 3D files.

📦 What is this software?

Substance 3d Viewer by Adobe

View all CVEs affecting Substance 3d Viewer →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Application crashes completely, potentially losing unsaved work and disrupting 3D design workflows.

🟠

Likely Case

Temporary application unavailability requiring restart, with possible data loss for unsaved projects.

🟢

If Mitigated

Minimal impact with proper file validation and user awareness preventing malicious file execution.

🌐 Internet-Facing: LOW - Requires user interaction with malicious files, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Internal users could be targeted via phishing or shared malicious files in collaborative environments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires user to open specially crafted malicious file. No authentication bypass needed but requires social engineering.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.25.3 or later

Vendor Advisory: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-99.html

Restart Required: No

Instructions:

1. Open Substance3D Viewer. 2. Go to Help > Check for Updates. 3. Install available update to version 0.25.3 or later. 4. Verify update completed successfully.

🔧 Temporary Workarounds

Restrict file sources

all

Only open Substance3D files from trusted sources and avoid opening files from unknown or untrusted origins.

🧯 If You Can't Patch

Implement application whitelisting to prevent execution of unauthorized files
Educate users about risks of opening files from untrusted sources and implement file validation procedures

🔍 How to Verify

Check if Vulnerable:

Check Substance3D Viewer version in application settings or About dialog. If version is 0.25.2 or earlier, system is vulnerable.

Check Version:

On Windows: Check Help > About in application. On macOS: Substance3D Viewer > About Substance3D Viewer

Verify Fix Applied:

Confirm Substance3D Viewer version is 0.25.3 or later in application settings.

📡 Detection & Monitoring

Log Indicators:

Application crash logs with memory access violations
Unexpected termination of Substance3D Viewer process

Network Indicators:

Unusual file downloads preceding application crashes

SIEM Query:

EventID=1000 OR EventID=1001 AND ProcessName="Substance3D Viewer.exe" AND Description CONTAINS "access violation"

📊 Metadata

CVE ID: CVE-2025-54275

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE: CWE-787

EPSS Score: 0.03% exploit probability (9.6th percentile)

Published: October 14, 2025

Last Updated: October 14, 2025

🔗 References

https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-99.html Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-54275, you might also want to check these: