CVE-2025-24441
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-24441 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Sampler versions 4.5.2 and earlier. This flaw occurs during the processing of malicious files, potentially leading to arbitrary code execution in the context of the current user. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on March 11, 2025.
Exploitation requires local access and user interaction, as a victim must open a specially crafted malicious file. An attacker with no privileges can leverage this to achieve full compromise of the affected system, gaining high-impact confidentiality, integrity, and availability effects through code execution under the user's privileges. Common vectors include social engineering tactics like phishing emails or shared files that entice users to load the malicious content in Substance3D Sampler.
Adobe Security Bulletin APSB25-16, available at https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html, details mitigation steps, including recommendations to update to a patched version of Substance3D Sampler.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The out-of-bounds write vulnerability enables arbitrary code execution when a user opens a specially crafted malicious file in the vulnerable application, directly mapping to T1204.002: Malicious File under User Execution.