EUVD-2026-100704
GHSA-pph3-9g5q-v36p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious asset file to victim
-
ExploitVictim opens file in Substance 3D Designer
-
ExecutionMalformed data overflows stack buffer in parser
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open a malicious, attacker-crafted file in Adobe Substance 3D Designer version 16.0.4 or earlier; this is reflected in the CVSS vector as AV:L (local, file-based) and UI:R (user interaction required). There is no network-triggerable or unauthenticated-remote path and no privilege prerequisite (PR:N) - the sole gating factor is tricking a user into opening the file. The limiting factors that reduce realistic risk are: (1) required active user interaction, (2) local file delivery rather than remote reach, and (3) impact confined to application availability (a crash), with no confidentiality or integrity consequences per Adobe's assessment. |
| Impact | This is a genuine but low-priority vulnerability. All exploitation signals point to limited real-world risk: the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 5.5 (Medium) and is driven entirely by availability impact - there is NO confidentiality or integrity impact, meaning the worst case is an application crash, not code execution or data compromise. The attack vector is LOCAL (AV:L) and requires user interaction (UI:R): a victim must be social-engineered into opening a malicious file, so there is no remote or automatable mass-exploitation path. No EPSS score, CISA KEV listing, or public POC was provided in the input, consistent with 'no public exploit identified at time of analysis.' Note a signal tension worth flagging: Adobe/NVD classify this as a Stack-based Buffer Overflow (CWE-121), a class often associated with code execution, yet Adobe scoped the impact strictly to denial-of-service (C:N/I:N) - defenders should treat it as a crash/DoS unless Adobe later revises the impact. Bottom line: a high-CWE category but a low-real-risk, DoS-only issue requiring user interaction - patch in normal cycle, not as an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Designer project or asset file with a malformed structure that overflows a stack buffer during parsing, then distributes it (e.g., via a shared asset marketplace, email, or collaboration workflow). When a 3D artist opens the file in a vulnerable version (≤16.0.4), the parser overflows the stack buffer and the application crashes, producing a denial-of-service. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Opening a crafted file in Adobe Substance 3D Designer 16.0.4 and earlier can overflow a stack buffer and crash the application, giving an attacker a denial-of-service condition against a local user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5, aligned with our independent assessment) confirms the trigger is a locally delivered file, requires the victim to manually open it, requires no privileges, and is scored purely for availability impact with no confidentiality or integrity loss; there is no network-reachable or unauthenticated-remote path. No public exploit code was identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV). This is a genuine but low-priority vulnerability whose realistic risk is constrained by the required user interaction, local file delivery, and crash-only impact.
RemediationAI
Patch availability is described by the vendor advisory rather than an enumerated fix version in the supplied data, so consult and apply Adobe security bulletin APSB26-169 (https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html) and upgrade Substance 3D Designer to the build it designates for CVE-2026-103823; any version later than 16.0.4 is outside the affected range stated by EUVD. If immediate patching is not possible, the highest-value compensating control is to stop untrusted files from reaching the application at all: block the relevant Substance Designer project/asset file extensions at mail and web gateways and via endpoint file-type policy, with the trade-off that legitimate exchange of these files with external partners is disrupted and a bypass exists (renamed extensions, archives, or shared network drives). Second, open untrusted content only inside a disposable VM, container, or sandboxed session with the application run as a non-privileged account, which contains the crash and prevents any escalation beyond the isolated host, at the cost of workflow overhead and the need to keep the sandbox image offline from production shares. Third, keep OS exploit mitigations such as ASLR, DEP/NX, and stack protection enabled; these reduce the chance of turning the overflow into control-flow hijack but will not stop the crash itself, so they are not a substitute for the patch. Because impact is confined to application availability, requires the user to open a malicious file, and has no pre-authentication remote path, remediation can be scheduled as routine maintenance rather than an emergency change, though reminding users not to open unsolicited design files remains a cheap and useful reduction in attack opportunity.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-121, stack-based buffer overflow: a fixed-size buffer allocated on the stack is populated from attacker-controlled input without adequate length validation, so a sufficiently large or malformed value overwrites adjacent stack memory - saved registers, return addresses, or canary values - and corrupts execution flow. In this case the input arrives when the user opens a malicious file in Adobe Substance 3D Designer, a 3D material/texture authoring application, meaning the vulnerable parsing logic sits in the file/asset loading path rather than in any network service; the provided data does not name a specific CPE, so the affected component cannot be pinpointed beyond the application itself. Because the overflow is reached only through local file parsing, the attack surface is the deserialization/import code path for user-supplied projects or assets, and the outcome Adobe scored is a crash (CWE-121 is also a classic control-flow-hijack primitive, but the assigned CVSS vector credits only availability impact, so no code-execution impact should be assumed). Standard platform mitigations (ASLR, DEP/NX, stack cookies, CFG) can reduce exploitability of the corrupted memory but do not prevent the malformed parse from terminating the process, so the denial-of-service remains achievable even on hardened hosts.
Know when Substance 3d Designer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File must be opened locally by a user, so AV:L and UI:R with no privileges (PR:N); impact is a crash only, so C:N/I:N and A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Substance 3d Designer
View allOut-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability t
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier via an out-of-bounds write vulnerability that trigg
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier through an out-of-bounds write vulnerability that r
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a cr
Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds writ
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability
Exploit-DB