CVE-2025-61806CWE-125

CVE-2025-61806

High · published October 15, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

⚡ Opening a crafted file could let attackers read memory like a book left wide open! 📖 Think of it like having a restaurant menu where someone can sneakily add a secret dish that contains instructions on how to get extra servings without paying — totally against the rules! This out-of-bounds read lets attackers peek beyond the allocated memory, just like a misplaced menu item allows for unauthorized access. If exploited, an attacker could execute malicious code within the context of the current user, potentially leading to a full compromise of their system. This means that a victim opening the wrong file could unwittingly give an attacker a foothold to wreak havoc — from stealing sensitive data to spreading malware!

Put simply

Think of it like having a restaurant menu where someone can sneakily add a secret dish that contains instructions on how to get extra servings without paying — totally against the rules! This out-of-bounds read lets attackers peek beyond the allocated memory, just like a misplaced menu item allows for unauthorized access. The vulnerability in Substance3D - Stager versions 3.1.4 and earlier stems from an out-of-bounds read when parsing crafted files. This flaw allows attackers to read past the end of an allocated memory structure, creating an opportunity to execute arbitrary code.

What to do

If exploited, an attacker could execute malicious code within the context of the current user, potentially leading to a full compromise of their system. This means that a victim opening the wrong file could unwittingly give an attacker a foothold to wreak havoc — from stealing sensitive data to spreading malware! To mitigate this risk, immediately update Substance3D - Stager to version 3.1.5 or later where the issue is addressed. Additionally, educate users to be cautious with files from untrusted sources. Implement security measures like antivirus software to scan files before opening. 🛡️ You've got this! By taking these steps, you can shore up your defenses and keep your systems secure! 🔒

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.2th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-10-15T00:15Z
Affected products (1)
ProductVersionsFixed in
adobe/substance_3d_stager< 3.1.53.1.5
References (1)
EPSS history
Timeline
  • 14 OCT 19:42Z
    Substance3D - Stager | Out-of-bounds Read (CWE-125)
    cvelistv5