CVE-2025-21139
Published: 14 January 2025
Description
Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Security Summary
CVE-2025-21139 is a heap-based buffer overflow vulnerability (CWE-122, CWE-787) affecting Adobe Substance3D Designer versions 14.0 and earlier. Published on January 14, 2025, the flaw occurs during the processing of malicious files and can lead to arbitrary code execution in the context of the current user. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
Exploitation requires local access and user interaction, specifically tricking a victim into opening a specially crafted malicious file within the affected software. No special privileges are needed (PR:N), and the attack complexity is low (AC:L). Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, potentially enabling full system compromise on the victim's machine if the user has elevated permissions.
Adobe's security bulletin APSB25-06, available at https://helpx.adobe.com/security/products/substance3d_designer/apsb25-06.html, details mitigation steps and patch information for addressing this vulnerability.
Details
- CWE(s)