CVE-2025-21161
Published: 11 February 2025
Summary
CVE-2025-21161 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Designer. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly eliminates the out-of-bounds write vulnerability by requiring timely remediation through application of Adobe patches for Substance3D Designer versions 14.0.2 and earlier.
Provides memory protections such as DEP and ASLR that prevent arbitrary code execution resulting from the out-of-bounds write exploitation.
Restricts usage to only approved and patched versions of Substance3D Designer, blocking execution of vulnerable software that could process malicious files.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables arbitrary code execution via opening a malicious file (user interaction required).
NVD Description
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2025-21161 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Designer versions 14.0.2 and earlier. Published on 2025-02-11, this flaw could result in arbitrary code execution in the context of the current user when exploited.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact with low attack complexity but requiring local access, no privileges, and user interaction. An attacker with a malicious file can exploit it by tricking a victim into opening the file in the affected software, achieving arbitrary code execution with high confidentiality, integrity, and availability impacts in the user's context.
Adobe Security Bulletin APSB25-12 details the vulnerability and mitigation recommendations, including available patches, at https://helpx.adobe.com/security/products/substance3d_designer/apsb25-12.html.
Details
- CWE(s)