Cyber Posture

CVE-2025-21137

High

Published: 14 January 2025

Published
14 January 2025
Modified
21 January 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0018 38.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-21137 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Substance 3D Designer. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 38.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the heap-based buffer overflow by remediating the flaw through application of vendor patches as detailed in Adobe's APSB25-06 bulletin.

prevent

Implements memory protections such as address space layout randomization and non-executable heap memory to prevent arbitrary code execution from heap buffer overflows.

preventdetect

Deploys malicious code protection mechanisms to scan and block malicious files crafted to exploit the buffer overflow vulnerability upon opening.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Heap buffer overflow enables arbitrary code execution via malicious file opened by user (T1204.002); directly matches exploitation for client execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…

more

must open a malicious file.

Deeper analysisAI

CVE-2025-21137 is a heap-based buffer overflow vulnerability affecting Adobe Substance3D Designer versions 14.0 and earlier. This issue, associated with CWE-122 and CWE-787, could result in arbitrary code execution in the context of the current user.

Exploitation requires user interaction, as a victim must open a malicious file. An attacker with local access and no privileges can craft and deliver such a file, leading to arbitrary code execution upon opening, with high confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity but dependence on local access and user action.

Adobe's security bulletin APSB25-06 at https://helpx.adobe.com/security/products/substance3d_designer/apsb25-06.html provides details on the vulnerability and mitigation recommendations.

Details

CWE(s)

Affected Products

adobe
substance 3d designer
≤ 14.1

CVEs Like This One

CVE-2025-21139Same product: Adobe Substance 3D Designer
CVE-2025-21169Same product: Adobe Substance 3D Designer
CVE-2025-21136Same product: Adobe Substance 3D Designer
CVE-2026-21334Same product: Adobe Substance 3D Designer
CVE-2026-21307Same product: Adobe Substance 3D Designer
CVE-2025-27172Same product: Adobe Substance 3D Designer
CVE-2026-21335Same product: Adobe Substance 3D Designer
CVE-2025-21161Same product: Adobe Substance 3D Designer
CVE-2025-21138Same product: Adobe Substance 3D Designer
CVE-2025-24439Same vendor: Adobe

References