CVE-2025-27173
Published: 11 March 2025
Summary
CVE-2025-27173 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Substance 3D Modeler. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and patching of flaws like the heap-based buffer overflow in Substance3D Modeler as detailed in Adobe bulletin APSB25-21.
Implements memory protection mechanisms such as ASLR and DEP to prevent arbitrary code execution from heap buffer overflows during malicious file parsing.
Restricts execution to authorized, patched versions of Substance3D Modeler, preventing use of vulnerable releases that could be exploited via malicious files.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in desktop client app triggered by opening malicious file enables arbitrary code execution, directly mapping to client-side exploitation (T1203) and user execution of malicious file (T1204.002).
NVD Description
Substance3D - Modeler versions 1.15.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
Deeper analysisAI
CVE-2025-27173 is a heap-based buffer overflow vulnerability (CWE-122) affecting Adobe Substance3D Modeler versions 1.15.0 and earlier. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H) and could result in arbitrary code execution in the context of the current user.
Exploitation requires local access and user interaction, where a victim must open a malicious file. An unprivileged local attacker can deliver such a file to trick the user into loading it within Substance3D Modeler, triggering the buffer overflow and enabling arbitrary code execution with the privileges of the affected process.
Adobe Security Bulletin APSB25-21 addresses this issue with details on patches and mitigation. Refer to https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-21.html for advisory information.
Details
- CWE(s)