CVE-2025-54273
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An out-of-bounds write vulnerability in Substance3D - Viewer versions 0.25.2 and earlier could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.
Risk Assessment
Opening a malicious file in the vulnerable application may allow an attacker to execute arbitrary code with the logged-in user's privileges, potentially leading to full system compromise.
Recommendation
Update Substance3D - Viewer to a version later than 0.25.2. Avoid opening files from untrusted sources and enforce least privilege for users opening files.
Other vulnerabilities in Substance3D - Viewer
See all- CVE-2025-54280High
An out-of-bounds write vulnerability in Substance3D - Viewer versions 0.25.2 and earlier could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.
- CVE-2025-54244High
Substance3D - Viewer versions 0.25.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Original NVD description (English source)
Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS