CVE-2025-21130
Published: 14 January 2025
Summary
CVE-2025-21130 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 41.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21130 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Stager versions 3.0.4 and earlier. The flaw occurs when processing malicious files, potentially leading to arbitrary code execution in the context of the current user. Published on January 14, 2025, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
Exploitation requires a local attacker with no privileges to craft a malicious file that a victim must open in Substance3D Stager, involving user interaction. Successful exploitation allows arbitrary code execution with the privileges of the current user, potentially enabling full system compromise if the user has elevated permissions.
Adobe's security bulletin APSB25-03, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb25-03.html, provides details on the vulnerability and recommends updating to a patched version of Substance3D Stager.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2237
Vulnerability details
Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in desktop app enables arbitrary code execution via crafted malicious file opened by user (T1204.002), directly mapping to client-side exploitation (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of known software flaws like this out-of-bounds write vulnerability by applying the vendor-recommended patch to Substance3D Stager.
Provides memory protection mechanisms such as DEP and ASLR that mitigate exploitation of out-of-bounds write vulnerabilities leading to arbitrary code execution.
Enables vulnerability scanning to identify systems running vulnerable versions of Substance3D Stager for prioritized patching.