CVE-2025-24439
Published: 11 March 2025
Summary
CVE-2025-24439 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Substance 3D Sampler. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the heap-based buffer overflow by requiring timely remediation through vendor patches for vulnerable Substance3D Sampler versions.
Protects against arbitrary code execution from the buffer overflow via memory safeguards like DEP and ASLR in the affected application process.
Prevents or controls user installation of vulnerable Substance3D Sampler versions, blocking the vector for opening malicious files.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a client-side heap buffer overflow in a desktop application triggered by processing a malicious file, enabling arbitrary code execution via user interaction. This directly maps to T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution).
NVD Description
Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
Deeper analysisAI
CVE-2025-24439 is a heap-based buffer overflow vulnerability (CWE-122, CWE-787) affecting Adobe Substance 3D Sampler versions 4.5.2 and earlier. Published on 2025-03-11, the flaw enables arbitrary code execution in the context of the current user when processing malicious files.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Local attackers with no privileges required can exploit it by tricking users into opening a specially crafted file, leading to full control over the affected process with high impacts on confidentiality, integrity, and availability.
Adobe's security bulletin APSB25-16 at https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html details the vulnerability and provides guidance on mitigation, including available patches.
Details
- CWE(s)