cvelistv5 - cve-2025-43582

CVE-2025-43582 (GCVE-0-2025-43582)

Vulnerability from cvelistv5 – Published: 2025-07-08 21:07 – Updated: 2025-07-10 03:55

Title

Substance3D - Viewer | Heap-based Buffer Overflow (CWE-122)

Summary

Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user, scope unchanged. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow (CWE-122)

Assigner

adobe

References

URL

Tags

https://helpx.adobe.com/security/products/substan…

vendor-advisory

Impacted products

	Vendor	Product	Version
	Adobe	Substance3D - Viewer	Affected: 0 , ≤ 0.22 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-43582",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-09T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-10T03:55:55.646Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Substance3D - Viewer",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "0.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-07-08T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user, scope unchanged. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow (CWE-122)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T21:07:22.621Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Substance3D - Viewer | Heap-based Buffer Overflow (CWE-122)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2025-43582",
    "datePublished": "2025-07-08T21:07:22.621Z",
    "dateReserved": "2025-04-16T16:23:13.182Z",
    "dateUpdated": "2025-07-10T03:55:55.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-43582\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2025-07-08T21:15:25.387\",\"lastModified\":\"2025-07-11T17:46:57.167\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user, scope unchanged. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\"},{\"lang\":\"es\",\"value\":\"Las versiones 0.22 y anteriores de Substance3D Viewer se ven afectadas por una vulnerabilidad de desbordamiento de b\u00fafer en el mont\u00f3n que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual, sin modificar el alcance. Para explotar este problema, la v\u00edctima debe abrir un archivo malicioso.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:substance_3d_viewer:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.25\",\"matchCriteriaId\":\"FD1FD43F-962D-458F-A3E5-C7BB36316A65\"}]}]}],\"references\":[{\"url\":\"https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-43582\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-09T13:43:33.075832Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-09T13:43:34.106Z\"}}], \"cna\": {\"title\": \"Substance3D - Viewer | Heap-based Buffer Overflow (CWE-122)\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"modifiedScope\": \"UNCHANGED\", \"temporalScore\": 7.8, \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"remediationLevel\": \"NOT_DEFINED\", \"reportConfidence\": \"NOT_DEFINED\", \"temporalSeverity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"environmentalScore\": 7.8, \"privilegesRequired\": \"NONE\", \"exploitCodeMaturity\": \"NOT_DEFINED\", \"integrityRequirement\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"LOCAL\", \"confidentialityImpact\": \"HIGH\", \"environmentalSeverity\": \"HIGH\", \"availabilityRequirement\": \"NOT_DEFINED\", \"modifiedIntegrityImpact\": \"HIGH\", \"modifiedUserInteraction\": \"REQUIRED\", \"modifiedAttackComplexity\": \"LOW\", \"confidentialityRequirement\": \"NOT_DEFINED\", \"modifiedAvailabilityImpact\": \"HIGH\", \"modifiedPrivilegesRequired\": \"NONE\", \"modifiedConfidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Adobe\", \"product\": \"Substance3D - Viewer\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"0.22\"}], \"defaultStatus\": \"affected\"}], \"datePublic\": \"2025-07-08T17:00:00.000Z\", \"references\": [{\"url\": \"https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user, scope unchanged. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"Heap-based Buffer Overflow (CWE-122)\"}]}], \"providerMetadata\": {\"orgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"shortName\": \"adobe\", \"dateUpdated\": \"2025-07-08T21:07:22.621Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-43582\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-09T16:05:14.430Z\", \"dateReserved\": \"2025-04-16T16:23:13.182Z\", \"assignerOrgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"datePublished\": \"2025-07-08T21:07:22.621Z\", \"assignerShortName\": \"adobe\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2025-17525

Vulnerability from cnvd - Published: 2025-07-28

Title

Adobe Substance 3D Viewer堆缓冲区溢出漏洞

Description

Adobe Substance 3D Viewer是Adobe推出的独立桌面应用，主要用于查看和编辑3D文件，并与Photoshop等应用无缝集成，支持非破坏性2D/3D协同创作。 Adobe Substance 3D Viewer存在堆缓冲区溢出漏洞，该漏洞源于堆内存部分被覆盖，攻击者可利用该漏洞提交特殊的文件请求，诱使用户解析，执行任意代码。

Severity

高

Patch Name

Adobe Substance 3D Viewer堆缓冲区溢出漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网： https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html

Reference

https://nvd.nist.gov/vuln/detail/CVE-2025-43582

Impacted products

Name
Adobe Substance 3D Viewer <=0.22

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-43582",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-43582"
    }
  },
  "description": "Adobe Substance 3D Viewer\u662fAdobe\u63a8\u51fa\u7684\u72ec\u7acb\u684c\u9762\u5e94\u7528\uff0c\u4e3b\u8981\u7528\u4e8e\u67e5\u770b\u548c\u7f16\u8f913D\u6587\u4ef6\uff0c\u5e76\u4e0ePhotoshop\u7b49\u5e94\u7528\u65e0\u7f1d\u96c6\u6210\uff0c\u652f\u6301\u975e\u7834\u574f\u60272D/3D\u534f\u540c\u521b\u4f5c\u3002\n\nAdobe Substance 3D Viewer\u5b58\u5728\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5806\u5185\u5b58\u90e8\u5206\u88ab\u8986\u76d6\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u6587\u4ef6\u8bf7\u6c42\uff0c\u8bf1\u4f7f\u7528\u6237\u89e3\u6790\uff0c\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-17525",
  "openTime": "2025-07-28",
  "patchDescription": "Adobe Substance 3D Viewer\u662fAdobe\u63a8\u51fa\u7684\u72ec\u7acb\u684c\u9762\u5e94\u7528\uff0c\u4e3b\u8981\u7528\u4e8e\u67e5\u770b\u548c\u7f16\u8f913D\u6587\u4ef6\uff0c\u5e76\u4e0ePhotoshop\u7b49\u5e94\u7528\u65e0\u7f1d\u96c6\u6210\uff0c\u652f\u6301\u975e\u7834\u574f\u60272D/3D\u534f\u540c\u521b\u4f5c\u3002\r\n\r\nAdobe Substance 3D Viewer\u5b58\u5728\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5806\u5185\u5b58\u90e8\u5206\u88ab\u8986\u76d6\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u6587\u4ef6\u8bf7\u6c42\uff0c\u8bf1\u4f7f\u7528\u6237\u89e3\u6790\uff0c\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Adobe Substance 3D Viewer\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Adobe Substance 3D Viewer \u003c=0.22"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-43582",
  "serverity": "\u9ad8",
  "submitTime": "2025-07-15",
  "title": "Adobe Substance 3D Viewer\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

GHSA-567R-5922-CGR8

Vulnerability from github – Published: 2025-07-08 21:30 – Updated: 2025-07-08 21:30

Details

Severity ?

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-43582"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-08T21:15:25Z",
    "severity": "HIGH"
  },
  "details": "Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user, scope unchanged. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
  "id": "GHSA-567r-5922-cgr8",
  "modified": "2025-07-08T21:30:28Z",
  "published": "2025-07-08T21:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43582"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2025-43582

Vulnerability from fkie_nvd - Published: 2025-07-08 21:15 - Updated: 2025-07-11 17:46

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@adobe.com	https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html	Vendor Advisory

Impacted products

	Vendor	Product	Version
	adobe	substance_3d_viewer	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:substance_3d_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD1FD43F-962D-458F-A3E5-C7BB36316A65",
              "versionEndExcluding": "0.25",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user, scope unchanged. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
    },
    {
      "lang": "es",
      "value": "Las versiones 0.22 y anteriores de Substance3D Viewer se ven afectadas por una vulnerabilidad de desbordamiento de b\u00fafer en el mont\u00f3n que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual, sin modificar el alcance. Para explotar este problema, la v\u00edctima debe abrir un archivo malicioso."
    }
  ],
  "id": "CVE-2025-43582",
  "lastModified": "2025-07-11T17:46:57.167",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-08T21:15:25.387",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ],
      "source": "psirt@adobe.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-43582 (GCVE-0-2025-43582)

CNVD-2025-17525

GHSA-567R-5922-CGR8

FKIE_CVE-2025-43582

Tags

Sightings

Nomenclature