CVE-2025-24443
Published: 11 March 2025
Summary
CVE-2025-24443 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Substance 3D Sampler. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 12.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-10 (Software Usage Restrictions).
Deeper analysis
CVE-2025-24443 is a heap-based buffer overflow vulnerability (CWE-122, CWE-787) affecting Adobe Substance 3D Sampler versions 4.5.2 and earlier. The issue could result in arbitrary code execution in the context of the current user.
Exploitation requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but user interaction is necessary as the victim must open a malicious file (UI:R). Successful exploitation allows an attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the user's scope (S:U), as reflected in the CVSS v3.1 base score of 7.8.
Mitigation details are provided in Adobe Security Bulletin APSB25-16, available at https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7649
Vulnerability details
Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap-based buffer overflow in client application (Adobe Substance 3D Sampler) triggered by opening a malicious file enables arbitrary code execution, directly mapping to T1203 (Exploitation for Client Execution) and T1204.002 (User Execution: Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation directly addresses the heap-based buffer overflow in Substance3D Sampler by applying vendor patches from APSB25-16 to prevent arbitrary code execution.
Memory protection safeguards such as ASLR and DEP mitigate exploitation of the heap buffer overflow even if a malicious file is opened in Substance3D Sampler.
Software usage restrictions limit execution to authorized, patched versions of Substance3D Sampler, preventing use of vulnerable releases like 4.5.2 and earlier.