CVE-2025-21132
Published: 14 January 2025
Summary
CVE-2025-21132 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 41.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21132 is an out-of-bounds write vulnerability (CWE-787) in Adobe Substance 3D Stager versions 3.0.4 and earlier. The flaw enables arbitrary code execution in the context of the current user upon opening a malicious file, as disclosed on January 14, 2025.
With a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability can be exploited by an attacker who has local access to the target system. Exploitation requires low complexity and no privileges but depends on user interaction, such as convincing the victim to open a specially crafted malicious file. Successful exploitation grants the attacker high-impact control over confidentiality, integrity, and availability, potentially fully compromising the affected user's system.
Adobe's security bulletin APSB25-03, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb25-03.html, provides details on the vulnerability and mitigation steps, including patches for affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2239
Vulnerability details
Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in client application enables RCE via malicious file open (T1203 Exploitation for Client Execution + T1204.002 Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of identified flaws, such as patching the out-of-bounds write vulnerability in Substance3D Stager versions 3.0.4 and earlier per Adobe APSB25-03.
Implements memory protection mechanisms like address space randomization and non-executable memory to block exploitation of the out-of-bounds write leading to arbitrary code execution.
Provides malicious code protection through scanning files upon opening or download, potentially identifying and blocking malicious files crafted to exploit the Substance3D Stager vulnerability.