Substance 3D Sampler CVE-2026-100131

Exploitation requires the victim to open an attacker-crafted malicious file in Adobe Substance 3D Sampler (version 6.0.3 or earlier); it is not triggerable remotely or without interaction. Limiting factors: the attack vector is local (AV:L), so the malicious file must be delivered to and manually opened by the user on the host running Sampler; mandatory user interaction (UI:R) means no automated or network-driven exploitation. No special product configuration is required beyond running an affected version and opening the file. Impact is confined to disclosure of sensitive process memory - there is no integrity or availability impact and no code execution claimed.

This is a genuine but moderate-priority issue, not a high-urgency one. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 5.5 MEDIUM) is internally consistent with the description: local attack vector, no privileges, but mandatory user interaction (victim must open a malicious file), with impact limited to confidentiality (C:H / I:N / A:N) via out-of-bounds read memory disclosure (CWE-125). There is no EPSS score, KEV listing, or POC in the provided data, so exploitation status is: no public exploit identified at time of analysis. The requirement for a local file to be opened by a victim substantially limits mass exploitation - this is a social-engineering / targeted-delivery vulnerability rather than a remotely-wormable one. No key signals conflict here; the main gap is the absence of EPSS/KEV data, but given the UI:R local vector, low real-world exploitation likelihood is expected. Impact is information disclosure only (no code execution or integrity/availability loss claimed), so even successful exploitation leaks memory rather than granting control.

An attacker crafts a malicious asset/project file (e.g., a texture or material file) and delivers it to a 3D artist via email, a shared asset library, or a download, relying on social engineering to get the victim to open it in Substance 3D Sampler. When parsed, the out-of-bounds read leaks adjacent process memory, which could expose sensitive data. No public exploit code is identified; the local vector and required user interaction make this a targeted rather than opportunistic attack.