Product:
Substance3D – Stager
Summary
Substance3D – Stager versions 3.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file. This could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-61806 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that, when opened by the victim using Substance3D – Stager, triggers the out-of-bounds read. This requires user interaction, as the victim must open the malicious file for the exploit to take effect.
Affected Products
- Substance3D – Stager versions 3.1.4 and earlier: Vulnerable to out-of-bounds read when parsing crafted files.
Mitigation
Users are advised to update to the latest version of Substance3D – Stager to mitigate this vulnerability. Additionally, avoid opening untrusted files to reduce the risk of exploitation.