CVE-2025-27181
Published: 11 March 2025
Summary
CVE-2025-27181 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Substance 3D Modeler. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 12.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-27181 is a Use After Free vulnerability (CWE-416) affecting Adobe Substance3D Modeler versions 1.15.0 and earlier. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and can lead to arbitrary code execution in the context of the current user.
Exploitation requires an attacker to deliver a malicious file to a victim, who must then open it using the affected software. The attacker needs local access to the system but no special privileges, and user interaction is mandatory. Successful exploitation grants the attacker high-impact control over confidentiality, integrity, and availability, enabling arbitrary code execution under the user's privileges.
Adobe Security Bulletin APSB25-21, available at https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-21.html, details mitigations and patches for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7756
Vulnerability details
Substance3D - Modeler versions 1.15.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a client-side UAF in a desktop application triggered by opening a malicious file, directly enabling T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File) for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and patching of the Use After Free flaw in Substance3D Modeler as detailed in Adobe bulletin APSB25-21.
Implements memory protections like ASLR and DEP that mitigate exploitation of the Use After Free vulnerability even in unpatched versions.
Enables scanning for CVE-2025-27181 in Substance3D Modeler installations to identify and prioritize remediation of vulnerable systems.