EUVD-2026-100694
GHSA-vqcv-8w4v-jw58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted asset file to victim
-
DeliveryVictim opens file in Substance 3D Sampler
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionLeak adjacent process memory
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker-supplied malicious file to be opened by a victim within Substance 3D Sampler version 6.0.3 or earlier; there is no remote or unauthenticated network path. Limiting factors: the attack is local (AV:L) and gated on user interaction (UI:R) - the victim must be socially engineered into importing/opening the crafted file - and the outcome is confined to disclosure of in-process memory (C:H, no integrity or availability impact and no code execution), so it functions as an information-leak primitive rather than a direct compromise. |
| Impact | This is a genuinely moderate-risk issue, not a top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) is internally consistent with the description: exploitation is LOCAL (AV:L) and requires a victim to open a malicious file (UI:R), with impact limited to confidentiality (C:H, I:N, A:N) via out-of-bounds memory disclosure (CWE-125). There is no network-vs-local conflict here - both the vector and the description agree the attacker cannot reach the target remotely and must rely on social engineering to get a crafted file opened. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input; absence of these is not itself a risk signal, but it means there is no evidence of active exploitation or public exploit code. Exploitation status: no public exploit identified at time of analysis. The combination of required user interaction, local attack vector, and confidentiality-only (read, not write/code-execution) impact means this is a high-CVSS-relative but realistically low-urgency issue - typical of client-side file-parser memory-disclosure bugs that are useful mainly as an information-leak primitive (e.g., to defeat ASLR) rather than a standalone compromise. |
| Exploit ScenarioDerived | An attacker crafts a malicious project or asset file and delivers it to a victim via phishing, a shared asset marketplace, or a collaboration channel. When the victim opens the file in Substance 3D Sampler (version 6.0.3 or earlier), the parser performs an out-of-bounds read, leaking adjacent process memory that may contain sensitive data. No public exploit code is identified at time of analysis, and the local vector plus required user interaction make this a targeted social-engineering scenario rather than mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Importing a specially crafted asset file into Adobe Substance 3D Sampler 6.0.3 or earlier can trigger an out-of-bounds read that leaks contents of the application's process memory to the attacker. The vulnerability is local in nature - there is no network or unauthenticated path to trigger it - and it is gated on user interaction, requiring the victim to be socially engineered into opening a malicious file; the outcome is limited to information disclosure with no integrity or availability impact and no code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is assessed as genuinely moderate risk rather than a top-tier priority.
RemediationAI
Apply the fix published in Adobe's advisory APSB26-159 (https://www.adobe.com/trust/security/products/substance3d-sampler/apsb26-159.html), which is the vendor's official remediation for this issue; upgrade Substance 3D Sampler to the patched release listed there and confirm the exact fixed build against the advisory before closing out, since the intelligence provided does not enumerate a specific patched version number. Until the upgrade is deployed, treat all Substance 3D Sampler asset files of unknown or untrusted origin as hostile: block or quarantine inbound .sbsar, project and texture asset files at mail and file-transfer gateways so they cannot reach authoring workstations, and require users to open only assets from trusted internal libraries or verified vendors - a control that has clear operational cost in collaborative pipelines where external assets are routine. Where the workflow permits, run Sampler in a sandboxed or low-privilege virtual machine or container with restricted file-system and network egress so that any leaked memory cannot be exfiltrated and is confined to a disposable environment; this reduces attacker value from the leak but adds friction and resource overhead. Note that the leak is a memory-disclosure primitive only, so classic exploit mitigations such as ASLR are not a meaningful substitute for patching, and there is no indication that disabling a specific feature or port will remove the exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds read (CWE-125) in the file-parsing path of Adobe Substance 3D Sampler, the material-authoring component of the Substance 3D suite used to scan, process and create PBR materials and asset libraries. When the application parses an attacker-supplied asset file, insufficient bounds validation on one or more read operations causes the parser to access memory beyond the intended buffer, returning adjacent heap or stack contents into the parsed data path, where they can be surfaced back to the attacker. Because the primitive is a read rather than a write, the impact is confined to confidentiality (C:H) and there is no corruption of control flow, so it does not by itself yield code execution. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N and the accompanying assessment confirm this framing: local attack vector, low complexity, no privileges required, mandatory user interaction, unchanged scope, high confidentiality impact only. No CPE entries were supplied with the intelligence, and the affected range is documented by EUVD as Substance 3D Sampler versions up to and including 6.0.3.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open attack (AV:L, UI:R) needing no prior privileges (PR:N); out-of-bounds read discloses memory so C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB