CVE-2025-61802
📋 TL;DR
CVE-2025-61802 is a use-after-free vulnerability in Substance3D Stager that could allow arbitrary code execution when a user opens a malicious file. This affects users of Substance3D Stager versions 3.1.4 and earlier. Successful exploitation requires user interaction through opening a specially crafted file.
💻 Affected Systems
- Adobe Substance3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware execution on the affected workstation, compromising user data and potentially spreading within the network.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only affecting the application itself.
🎯 Exploit Status
Exploitation requires user to open malicious file; no known public exploits as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.5 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb25-104.html
Restart Required: Yes
Instructions:
1. Open Substance3D Stager. 2. Go to Help > Check for Updates. 3. Install available update to version 3.1.5 or later. 4. Restart the application.
🔧 Temporary Workarounds
Restrict file opening
allConfigure application to only open trusted files from known sources
Application sandboxing
allRun Substance3D Stager in restricted environment/sandbox
🧯 If You Can't Patch
- Implement application control policies to restrict execution of Substance3D Stager
- Educate users to avoid opening untrusted .sbsar or other Substance3D files from unknown sources
🔍 How to Verify
Check if Vulnerable:
Check Substance3D Stager version in application (Help > About) - if version is 3.1.4 or earlier, system is vulnerable.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 3.1.5 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected file opening events in Substance3D Stager
Network Indicators:
- Unusual outbound connections after file opening
- File downloads from untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="Stager.exe" AND ExceptionCode="0xc0000005"