The version of Adobe Substance 3D Stager installed on the remote host is prior to 3.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-03 advisory.

  - Substance3D - Stager versions 3.0.4 and earlier are affected by a Stack-based Buffer Overflow     vulnerability that could result in arbitrary code execution in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2025-21128)

  - Substance3D - Stager versions 3.0.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability     that could result in arbitrary code execution in the context of the current user. Exploitation of this     issue requires user interaction in that a victim must open a malicious file. (CVE-2025-21129)

  - Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that     could result in arbitrary code execution in the context of the current user. Exploitation of this issue     requires user interaction in that a victim must open a malicious file. (CVE-2025-21130, CVE-2025-21131,     CVE-2025-21132)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Adobe Substance 3D Stager 3.1.0 Multiple Vulnerabilities (APSB25-03)

high Nessus Plugin ID 214309

Version 1.2

Version 1.1

Version 1.2 Feb 14, 2025, 12:18 PM IAVM reference Plugin Feed: 202502141218
Version 1.1 Jan 17, 2025, 6:12 PM New Plugin Feed: 202501171812