CVE-2025-21129
Published: 14 January 2025
Summary
CVE-2025-21129 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21129 is a heap-based buffer overflow vulnerability (CWE-122, CWE-787) affecting Adobe Substance 3D Stager versions 3.0.4 and earlier. Published on 2025-01-14, the flaw enables arbitrary code execution in the context of the current user upon processing a malicious file.
The attack requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but demands user interaction (UI:R) as the victim must open a specially crafted malicious file in the affected software. Successful exploitation results in high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H) with no change in scope (S:U), yielding a CVSS v3.1 base score of 7.8 and allowing the attacker to execute arbitrary code as the current user.
Adobe's security bulletin APSB25-03 provides details on the vulnerability and mitigation steps, accessible at https://helpx.adobe.com/security/products/substance3d_stager/apsb25-03.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2236
Vulnerability details
Substance3D - Stager versions 3.0.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in client app enables arbitrary code execution via malicious file opened by user (T1204.002), directly matching Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the specific heap-based buffer overflow vulnerability through application of Adobe's patch as detailed in APSB25-03.
Implements memory protections such as ASLR and DEP that mitigate unauthorized code execution from heap buffer overflows.
Enables scanning to identify systems with vulnerable versions of Substance 3D Stager affected by this CVE.