Product:
Substance3D – Modeler
Summary
Substance3D – Modeler versions 1.22.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file. This could result in a read past the end of an allocated memory structure, allowing an attacker to execute code in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-54260 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious file that, when opened by the victim using Substance3D – Modeler, triggers the out-of-bounds read. This requires the victim to be tricked into opening the crafted file, which can lead to code execution in the context of the user running the application.
Affected Products
- Substance3D – Modeler versions 1.22.2 and earlier: Affected by an out-of-bounds read vulnerability that can lead to code execution.
Mitigation
To mitigate this vulnerability, users should update to the latest version of Substance3D – Modeler. Additionally, users should avoid opening files from untrusted sources to reduce the risk of exploitation.