CVE-2025-49571

Substance3D - Modeler versions 1.22.0 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses an uncontrolled search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:substance_3d_modeler:*:*:*:*:*:*:*:*

History

13 Aug 2025, 18:15

Type	Values Removed	Values Added
First Time		Adobe Adobe substance 3d Modeler
CPE		cpe:2.3:a:adobe:substance_3d_modeler::::::::
References	~~() https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html -~~	() https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html - Vendor Advisory

13 Aug 2025, 17:33

Type	Values Removed	Values Added
Summary		(es) Las versiones 1.22.0 y anteriores de Substance3D - Modeler se ven afectadas por una vulnerabilidad de elemento de ruta de búsqueda no controlada que podría provocar la ejecución de código arbitrario en el contexto del usuario actual. Si la aplicación utiliza una ruta de búsqueda no controlada para localizar recursos críticos, como programas, un atacante podría modificarla para que apunte a un programa malicioso, que la aplicación objetivo ejecutaría. La explotación de este problema no requiere la interacción del usuario.

12 Aug 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-12 21:15

Updated : 2025-08-13 18:15

NVD link : CVE-2025-49571

Mitre link : CVE-2025-49571

CVE.ORG link : CVE-2025-49571

JSON object : View

Products Affected

adobe

substance_3d_modeler

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2025-49571", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-08-12T21:15:31.043", "references": [{"url": "https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Substance3D - Modeler versions 1.22.0 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses an uncontrolled search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction."}, {"lang": "es", "value": "Las versiones 1.22.0 y anteriores de Substance3D - Modeler se ven afectadas por una vulnerabilidad de elemento de ruta de b\u00fasqueda no controlada que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. Si la aplicaci\u00f3n utiliza una ruta de b\u00fasqueda no controlada para localizar recursos cr\u00edticos, como programas, un atacante podr\u00eda modificarla para que apunte a un programa malicioso, que la aplicaci\u00f3n objetivo ejecutar\u00eda. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."}], "lastModified": "2025-08-13T18:15:50.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:substance_3d_modeler:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D96F601F-CE39-47F5-8F38-D8F6F4368875", "versionEndExcluding": "1.22.2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}