CVE-2025-61803
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An Integer Overflow or Wraparound vulnerability in Substance3D - Stager versions 3.1.4 and earlier could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.
Risk Assessment
A user opening a crafted file could allow arbitrary code execution with their privileges, potentially compromising the workstation and exposing data.
Recommendation
Update Substance3D - Stager to a version later than 3.1.4 and instruct users not to open files from untrusted sources.
Other vulnerabilities in Substance3D - Stager
See all- CVE-2026-21287High
Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction – the victim must open a malicious file.
- CVE-2025-61807High
An Integer Overflow or Wraparound vulnerability in Substance3D - Stager versions 3.1.4 and earlier could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction — the victim must open a malicious file.
- CVE-2025-61806High
An out-of-bounds read vulnerability in Substance3D - Stager versions 3.1.4 and earlier when parsing a crafted file could result in a read past the end of an allocated memory structure. An attacker could leverage this to execute code in the context of the current user. Exploitation requires user interaction — the victim must open a malicious file.
- CVE-2025-61805High
An out-of-bounds read vulnerability in Substance3D - Stager versions 3.1.4 and earlier when parsing a crafted file could result in a read past the end of an allocated memory structure. An attacker could leverage this to execute code in the context of the current user. Exploitation requires user interaction — the victim must open a malicious file.
Original NVD description (English source)
Substance3D - Stager versions 3.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS