Cyber Posture

CVE-2025-27173

High

Published: 11 March 2025

Published
11 March 2025
Modified
18 April 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0004 10.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-27173 is a heap-based buffer overflow vulnerability (CWE-122) affecting Adobe Substance3D Modeler versions 1.15.0 and earlier. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H) and could result in arbitrary code execution in the context of the current user.

Exploitation requires local access and user interaction, where a victim must open a malicious file. An unprivileged local attacker can deliver such a file to trick the user into loading it within Substance3D Modeler, triggering the buffer overflow and enabling arbitrary code execution with the privileges of the affected process.

Adobe Security Bulletin APSB25-21 addresses this issue with details on patches and mitigation. Refer to https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-21.html for advisory information.

Details

CWE(s)
CWE-122

Affected Products

adobe
substance 3d modeler
≤ 1.15.0

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Heap buffer overflow in desktop client app triggered by opening malicious file enables arbitrary code execution, directly mapping to client-side exploitation (T1203) and user execution of malicious file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References