CVE-2025-24442
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-24442 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Sampler versions 4.5.2 and earlier. The flaw occurs when processing files and can result in arbitrary code execution in the context of the current user.
Exploitation requires local access (AV:L) with low attack complexity (AC:L) and no privileges (PR:N), but user interaction (UI:R) is necessary, as a victim must open a malicious file. A successful attack allows an attacker to gain high-impact confidentiality, integrity, and availability effects (C:H/I:H/A:H) within the user's scope (S:U), earning a CVSS v3.1 base score of 7.8.
Adobe's security bulletin APSB25-16 provides details on the vulnerability and mitigation, available at https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is triggered by processing a malicious file, directly enabling arbitrary code execution via user interaction with a malicious file (T1204.002).