CVE-2025-24442
Published: 11 March 2025
Summary
CVE-2025-24442 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Sampler. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 9.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-24442 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Sampler versions 4.5.2 and earlier. The flaw occurs when processing files and can result in arbitrary code execution in the context of the current user.
Exploitation requires local access (AV:L) with low attack complexity (AC:L) and no privileges (PR:N), but user interaction (UI:R) is necessary, as a victim must open a malicious file. A successful attack allows an attacker to gain high-impact confidentiality, integrity, and availability effects (C:H/I:H/A:H) within the user's scope (S:U), earning a CVSS v3.1 base score of 7.8.
Adobe's security bulletin APSB25-16 provides details on the vulnerability and mitigation, available at https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7648
Vulnerability details
Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is triggered by processing a malicious file, directly enabling arbitrary code execution via user interaction with a malicious file (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the out-of-bounds write vulnerability in Substance3D Sampler through timely patching, preventing arbitrary code execution from malicious files.
Implements memory safeguards such as DEP and ASLR to block exploitation of the out-of-bounds write leading to code execution in the current user context.
Scans systems for the specific vulnerable versions of Substance3D Sampler (4.5.2 and earlier), enabling identification and prioritization for remediation.