CVE-2025-57521 Code injection in n/a
A local attacker can execute arbitrary code by placing a malicious unsigned plugin in a user-controlled directory, exploiting Bambu Studio's lack of signature validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-57521?
CVE-2025-57521 is a medium-severity code injection vulnerability in n/a, published on 21 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a network plugin without validating its digital signature or verifying its authenticity. A local attacker can exploit this behavior by placing a malicious component in the expected location, which is controllable by the attacker (e.g., under %APPDATA%), resulting in code execution within the context of the user. The main application is digitally signed, which may allow a malicious component to inherit trust and evade detection by security solutions that rely on signed parent processes.
Weakness: CWE-77
Which versions are affected by CVE-2025-57521?
How do I fix CVE-2025-57521?
No fix has been published for CVE-2025-57521 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-57521 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57521 exists.
Sources
Also known as GHSA-mgv2-737c-m3c7.