CVE-2025-21139
Published: 14 January 2025
Summary
CVE-2025-21139 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Substance 3D Designer. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 38.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely flaw remediation through patching the heap-based buffer overflow vulnerability in Substance3D Designer versions 14.0 and earlier.
Implements memory protections such as DEP, ASLR, and heap hardening that directly mitigate exploitation of heap-based buffer overflows for arbitrary code execution.
Enforces validation of file inputs to prevent malformed files from triggering the buffer overflow during processing in Substance3D Designer.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow enables arbitrary code execution via malicious file opened by user (T1204.002), directly exploiting client application vulnerability (T1203).
NVD Description
Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
Deeper analysisAI
CVE-2025-21139 is a heap-based buffer overflow vulnerability (CWE-122, CWE-787) affecting Adobe Substance3D Designer versions 14.0 and earlier. Published on January 14, 2025, the flaw occurs during the processing of malicious files and can lead to arbitrary code execution in the context of the current user. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
Exploitation requires local access and user interaction, specifically tricking a victim into opening a specially crafted malicious file within the affected software. No special privileges are needed (PR:N), and the attack complexity is low (AC:L). Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, potentially enabling full system compromise on the victim's machine if the user has elevated permissions.
Adobe's security bulletin APSB25-06, available at https://helpx.adobe.com/security/products/substance3d_designer/apsb25-06.html, details mitigation steps and patch information for addressing this vulnerability.
Details
- CWE(s)