CVE-2025-24451
Published: 11 March 2025
Summary
CVE-2025-24451 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Painter. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 12.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely patching of Substance3D Painter to remediate the out-of-bounds write vulnerability.
Enables vulnerability scanning to identify vulnerable versions of Substance3D Painter and initiate remediation for this flaw.
Implements memory protections like ASLR and DEP to mitigate arbitrary code execution from the out-of-bounds write exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an out-of-bounds write in a client application that triggers arbitrary code execution when a user opens a crafted malicious file, directly mapping to T1204.002 Malicious File.
NVD Description
Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2025-24451 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Painter versions 10.1.2 and earlier. Published on 2025-03-11, the flaw can lead to arbitrary code execution in the context of the current user when processing malicious files.
With a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability requires local access and user interaction for exploitation. An attacker with local access can craft a malicious file that, when opened by a victim in Substance3D Painter, triggers the out-of-bounds write, resulting in arbitrary code execution with the privileges of the current user.
Adobe Security Bulletin APSB25-18 details the issue and mitigation steps, including available patches. For full advisory information, refer to https://helpx.adobe.com/security/products/substance3d_painter/apsb25-18.html.
Details
- CWE(s)