CVE-2025-61835
📋 TL;DR
Substance3D Stager versions 3.1.5 and earlier contain an integer underflow vulnerability that could allow arbitrary code execution when a user opens a malicious file. This affects users of Adobe's Substance3D Stager software who open untrusted project files. The vulnerability requires user interaction but could lead to full system compromise.
💻 Affected Systems
- Adobe Substance3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malicious actor tricks user into opening a specially crafted project file, leading to malware installation or data exfiltration.
If Mitigated
User opens file from trusted source only, resulting in no exploitation despite vulnerable software.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of file format structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.6 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb25-113.html
Restart Required: Yes
Instructions:
1. Open Substance3D Stager. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Restart the application.
🔧 Temporary Workarounds
Restrict file opening
allOnly open Substance3D Stager project files from trusted sources
Application control
allUse application whitelisting to prevent execution of unauthorized binaries
🧯 If You Can't Patch
- Implement strict file handling policies to only open trusted project files
- Run Substance3D Stager in isolated environment or virtual machine
🔍 How to Verify
Check if Vulnerable:
Check Substance3D Stager version in Help > About. If version is 3.1.5 or earlier, system is vulnerable.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 3.1.6 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual file access patterns from Substance3D Stager process
Network Indicators:
- Outbound connections from Substance3D Stager to unknown IPs after file opening
SIEM Query:
process_name:"Substance3D Stager" AND (event_type:crash OR file_path:*.sbs OR file_path:*.sbsar)