CVE-2025-21137
Published: 14 January 2025
Summary
CVE-2025-21137 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Substance 3D Designer. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21137 is a heap-based buffer overflow vulnerability affecting Adobe Substance3D Designer versions 14.0 and earlier. This issue, associated with CWE-122 and CWE-787, could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. An attacker with local access and no privileges can craft and deliver such a file, leading to arbitrary code execution upon opening, with high confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity but dependence on local access and user action.
Adobe's security bulletin APSB25-06 at https://helpx.adobe.com/security/products/substance3d_designer/apsb25-06.html provides details on the vulnerability and mitigation recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2244
Vulnerability details
Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow enables arbitrary code execution via malicious file opened by user (T1204.002); directly matches exploitation for client execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the heap-based buffer overflow by remediating the flaw through application of vendor patches as detailed in Adobe's APSB25-06 bulletin.
Implements memory protections such as address space layout randomization and non-executable heap memory to prevent arbitrary code execution from heap buffer overflows.
Deploys malicious code protection mechanisms to scan and block malicious files crafted to exploit the buffer overflow vulnerability upon opening.