Cyber Posture

CVE-2025-21169

High

Published: 11 March 2025

Published
11 March 2025
Modified
28 April 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0004 10.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-21169 is a heap-based buffer overflow vulnerability (CWE-122, CWE-787) affecting Adobe Substance3D Designer versions 14.1 and earlier. The flaw could result in arbitrary code execution in the context of the current user. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability with low attack complexity but requiring local access and user interaction.

Exploitation requires an attacker to trick a victim into opening a malicious file within the affected software. No privileges are needed beforehand (PR:N), but the attack is local (AV:L) and depends on user interaction (UI:R). Successful exploitation allows arbitrary code execution under the current user's context, potentially leading to full system compromise if the user has elevated privileges.

Adobe Security Bulletin APSB25-22 provides details on the vulnerability and mitigation. Security practitioners should consult https://helpx.adobe.com/security/products/substance3d_designer/apsb25-22.html for patch availability and recommended remediation steps.

Details

CWE(s)
CWE-122CWE-787

Affected Products

adobe
substance 3d designer
≤ 14.1.1

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

The heap-based buffer overflow enables arbitrary code execution in a client application when a user opens a malicious file, directly mapping to Exploitation for Client Execution (T1203) and User Execution via Malicious File (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References