Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a network plugin without validating its digital signature or verifying its authenticity. A local attacker can exploit this behavior by placing a malicious component in the expected location, which is controllable by the attacker (e.g., under %APPDATA%), resulting in code execution within the context of the user. The main application is digitally signed, which may allow a malicious component to inherit trust and evade detection by security solutions that rely on signed parent processes.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Tue, 21 Oct 2025 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-77 | |
| Metrics |
cvssV3_1
|
Tue, 21 Oct 2025 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a network plugin without validating its digital signature or verifying its authenticity. A local attacker can exploit this behavior by placing a malicious component in the expected location, which is controllable by the attacker (e.g., under %APPDATA%), resulting in code execution within the context of the user. The main application is digitally signed, which may allow a malicious component to inherit trust and evade detection by security solutions that rely on signed parent processes. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-10-21T20:23:58.712Z
Reserved: 2025-08-17T00:00:00.000Z
Link: CVE-2025-57521
Vulnrichment
Updated: 2025-10-21T20:23:53.409Z
NVD
Status : Awaiting Analysis
Published: 2025-10-21T15:15:38.960
Modified: 2025-10-21T21:15:38.737
Link: CVE-2025-57521
Redhat
No data.
OpenCVE Enrichment
No data.