EUVD-2026-100706
GHSA-vcwm-mprp-qjcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious Substance file to victim
-
DeliveryVictim opens file in Designer
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionLeak adjacent process memory
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open an attacker-controlled malicious file in Adobe Substance 3D Designer version 16.0.4 or earlier; it cannot be triggered remotely or without user action. There is no privilege or authentication prerequisite on the attacker side, but the mandatory user interaction (opening the crafted file) and the local-only attack vector are the key limiting factors. The leaked data is limited to in-process memory contents of Substance 3D Designer, and the attacker must have a means to recover the disclosed information from the application. |
| Impact | This is a moderate-severity information disclosure flaw (CVSS 5.5) that should be treated as routine patch-cycle priority rather than an emergency. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) is internally consistent with the description: exploitation is local and requires a victim to open a malicious file, so there is no remote network-facing exposure. The vector is unauthenticated (PR:N) but gated by required user interaction (UI:R), which materially lowers real-world risk. The out-of-bounds read (CWE-125) impacts confidentiality only (C:H/I:N/A:N) - it can leak sensitive process memory but cannot modify data or crash/deny service per the scored vector. There is no CISA KEV listing and no EPSS score provided in the input, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No signals conflict here; the primary limiting factor is the social-engineering requirement (user must open an attacker-supplied file), which makes this suited to targeted phishing of 3D-content creators rather than mass exploitation. EPSS and SSVC data were not supplied and cannot be factored in. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D material or project file and delivers it to a victim (e.g., via a shared asset pack, marketplace download, or phishing email). When the victim opens the file in Substance 3D Designer, the parser performs an out-of-bounds read that leaks adjacent process memory, potentially exposing sensitive in-memory data back to the attacker. No public exploit code is identified at time of analysis, and successful exploitation depends entirely on the victim opening the crafted file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in Adobe Substance 3D Designer 16.0.4 and earlier can disclose sensitive contents of process memory when a user opens a specially crafted file, yielding a moderate-severity information disclosure (CVSS 5.5, CWE-125). The attack is local-only and cannot be triggered remotely: it requires the victim to interact with the application by manually opening an attacker-controlled file, and there is no privilege or authentication prerequisite on the attacker's side. No public exploit code or confirmed active exploitation was identified at time of analysis, and because the leaked data is limited to the application's in-process memory - which the attacker must still find a way to recover - this should be handled as a routine patch-cycle priority rather than an emergency response.
RemediationAI
Apply the fixed build published in Adobe's security bulletin APSB26-169 (https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html), which covers Substance 3D Designer 16.0.4 and earlier; update through the Creative Cloud desktop application or the standalone updater and verify the installed version is later than 16.0.4 before closing the finding, since an exact fix version string was not present in the provided intelligence and should be taken from the bulletin itself. Where immediate patching is not possible, compensating controls should target the user-interaction prerequisite: block or quarantine untrusted .sbs/.sbsar and other Substance project files at email and file-sharing gateways so users cannot receive the malicious input, and restrict designers from opening files sourced outside trusted repositories - with the trade-off that this slows legitimate collaboration and may break asset exchange with external partners. Additional hardening includes running Substance 3D Designer under a low-privilege desktop account or inside an isolated/sandboxed VM when handling untrusted assets, so anything leaked from process memory has limited value, and enabling endpoint detection for anomalous child processes or outbound connections spawned by the application after a file is opened. These measures reduce exposure but do not eliminate the flaw, so patching remains the primary and only complete remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic out-of-bounds read (CWE-125) in Adobe Substance 3D Designer, a node-based procedural material and texture authoring tool; the vulnerability most plausibly resides in the file-parsing path used when the application loads a designer project or substance package supplied by a user. Because the parser trusts length or offset fields in the crafted file, it can read past the boundaries of an allocated buffer and surface adjacent heap or stack contents into application state that may later be exposed to the attacker, resulting in memory disclosure rather than code execution. The assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms the precise risk shape: local attack vector, low attack complexity once a malicious file is delivered, no privileges required, mandatory user interaction, unchanged scope, and high confidentiality impact with no integrity or availability effect. The associated tags - Buffer Overflow and Information Disclosure - align with the out-of-bounds read classification, and the report originates from Adobe's own PSIRT (psirt@adobe.com), with ENISA EUVD-2026-100706 tracking the same issue. Note that although an out-of-bounds read can sometimes be chained into a more severe primitive (for example as an ASLR-defeating memory leak in a full exploit chain), nothing in the available data indicates such chaining here, and the impact should be scoped to information disclosure in the context of the local, user-interaction-gated access model.
Know when Substance 3d Designer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File must be opened locally by a victim so AV:L and UI:R; no attacker privileges needed (PR:N); out-of-bounds read affects confidentiality only, so C:H with I:N/A:N.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Substance 3d Designer
View allOut-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability t
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier via an out-of-bounds write vulnerability that trigg
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier through an out-of-bounds write vulnerability that r
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a cr
Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds writ
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability
Exploit-DB