Product:
Substance3D – Modeler
Summary
Substance3D – Modeler versions 1.22.3 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file. This could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user, requiring user interaction to exploit.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-54276 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that, when opened by the victim using Substance3D – Modeler, triggers the out-of-bounds read. The victim must be convinced to open this file, which allows the attacker to execute code with the same privileges as the user running the application.
Affected Products
- Substance3D – Modeler versions 1.22.3 and earlier: Vulnerable to out-of-bounds read when parsing crafted files.
Mitigation
To mitigate this vulnerability, users should update to the latest version of Substance3D – Modeler that addresses this issue. Additionally, users should avoid opening files from untrusted sources to reduce the risk of exploitation.