CVE-2025-21128 Overview
CVE-2025-21128 is a stack-based buffer overflow vulnerability affecting Adobe Substance3D Stager version 3.0.4 and earlier. The flaw allows attackers to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a crafted malicious file in Substance3D Stager.
Adobe published security advisory APSB25-03 on January 14, 2025, addressing this and related issues. The vulnerability is classified under [CWE-121] Stack-based Buffer Overflow and [CWE-787] Out-of-bounds Write. It affects installations on both Microsoft Windows and Apple macOS.
Critical Impact
A successful exploit grants the attacker code execution at the privilege level of the user running Substance3D Stager, enabling persistence, lateral movement, or data theft.
Affected Products
- Adobe Substance3D Stager versions 3.0.4 and earlier
- Microsoft Windows installations of Substance3D Stager
- Apple macOS installations of Substance3D Stager
Discovery Timeline
- 2025-01-14 - Adobe releases security bulletin APSB25-03 with patched version
- 2025-01-14 - CVE-2025-21128 published to the National Vulnerability Database (NVD)
- 2025-01-17 - Last updated in NVD database
Technical Details for CVE-2025-21128
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow [CWE-121] in Adobe Substance3D Stager's file parsing logic. When the application processes a malformed 3D asset or project file, data is written past the bounds of a fixed-size stack buffer [CWE-787]. The overflow corrupts adjacent stack memory, including saved return addresses and local control structures.
An attacker who controls the overflow contents can overwrite the return address and redirect execution to attacker-supplied code. Because the attack vector is local and requires user interaction, exploitation typically involves social engineering. Victims receive a malicious .sbs, .ssa, or related project file and open it within the vulnerable application.
The EPSS probability of exploitation stands at 0.176% (38.78th percentile), reflecting the user-interaction requirement. No public proof-of-concept or in-the-wild exploitation has been reported.
Root Cause
The defect originates in input parsing routines that fail to validate length fields before copying file-derived data into stack-allocated buffers. Without bounds checking, oversized records overwrite saved frame pointers and return addresses. Adobe has not published implementation specifics in the public advisory.
Attack Vector
The attack requires local access and user interaction. An attacker crafts a malicious Substance3D project file and delivers it through phishing, file-sharing services, or compromised asset marketplaces. When the target opens the file in a vulnerable Stager build, the parser triggers the overflow and executes the embedded payload under the user's account.
No verified proof-of-concept code is publicly available. Refer to the Adobe Security Advisory APSB25-03 for vendor-provided technical context.
Detection Methods for CVE-2025-21128
Indicators of Compromise
- Unexpected child processes spawned by Adobe Substance 3D Stager.exe or the macOS equivalent binary
- Substance3D project files (.sbs, .ssa, .stager) arriving from untrusted email senders or external file shares
- Crash dumps or Windows Error Reporting events referencing access violations in the Stager process after opening a 3D asset
Detection Strategies
- Monitor endpoint telemetry for Stager processes performing shell execution, script interpreter launches, or network connections immediately after file open events
- Inspect downloaded Substance3D files using static analysis to flag malformed headers or oversized record fields
- Correlate file-open events for Substance3D file extensions with subsequent process creation chains in EDR data
Monitoring Recommendations
- Alert on Stager binaries writing to autorun locations, scheduled task stores, or LaunchAgents directories
- Track outbound network connections initiated by the Stager process, which should normally be limited to Adobe update endpoints
- Review user inventories for outdated Substance3D Stager versions at or below 3.0.4 across Windows and macOS endpoints
How to Mitigate CVE-2025-21128
Immediate Actions Required
- Upgrade Adobe Substance3D Stager to the fixed version listed in Adobe APSB25-03 on all Windows and macOS endpoints
- Inventory affected workstations and prioritize designers, 3D artists, and engineering hosts where Stager is installed
- Block delivery of unsolicited Substance3D project files at email and web gateways pending patch deployment
Patch Information
Adobe addressed CVE-2025-21128 in security bulletin APSB25-03, released January 14, 2025. Customers should install the latest Substance3D Stager build via the Adobe Creative Cloud desktop application or the Adobe download portal. Verify the installed version exceeds 3.0.4 after update.
Workarounds
- Restrict opening of Substance3D project files to those received from verified internal sources
- Apply application allowlisting to prevent untrusted child processes from spawning under the Stager binary
- Enforce standard user privileges so that successful exploitation does not yield administrative access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
