CVE-2025-21128
Published: 14 January 2025
Summary
CVE-2025-21128 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 38.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of Substance3D Stager to fix the stack-based buffer overflow vulnerability and prevent arbitrary code execution.
Memory protection implements safeguards like ASLR, DEP, and stack canaries to block exploitation of the stack-based buffer overflow for arbitrary code execution.
Malicious code protection scans potentially malicious files before opening, mitigating user-interaction-based exploitation of the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in file-processing app enables arbitrary code execution upon opening a crafted malicious file, directly mapping to T1204.002.
NVD Description
Substance3D - Stager versions 3.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
Deeper analysisAI
CVE-2025-21128 is a stack-based buffer overflow vulnerability (CWE-121, CWE-787) affecting Adobe Substance3D Stager versions 3.0.4 and earlier. The flaw occurs when processing malicious files, potentially leading to arbitrary code execution in the context of the current user.
Exploitation requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but user interaction (UI:R) is necessary, as a victim must open a specially crafted malicious file. Successful exploitation grants the attacker high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) without scope change (S:U), resulting in a CVSS v3.1 base score of 7.8.
Adobe Security Bulletin APSB25-03 provides details on the vulnerability and mitigation, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb25-03.html.
Details
- CWE(s)