CVE-2025-21128
Published: 14 January 2025
Description
Substance3D - Stager versions 3.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Security Summary
CVE-2025-21128 is a stack-based buffer overflow vulnerability (CWE-121, CWE-787) affecting Adobe Substance3D Stager versions 3.0.4 and earlier. The flaw occurs when processing malicious files, potentially leading to arbitrary code execution in the context of the current user.
Exploitation requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but user interaction (UI:R) is necessary, as a victim must open a specially crafted malicious file. Successful exploitation grants the attacker high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) without scope change (S:U), resulting in a CVSS v3.1 base score of 7.8.
Adobe Security Bulletin APSB25-03 provides details on the vulnerability and mitigation, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb25-03.html.
Details
- CWE(s)