EUVD-2026-100705
GHSA-8x7p-6vxc-2q48
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Substance 3D file
-
DeliveryDeliver via phishing or asset share
-
ExploitVictim opens file in Designer
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactDisclose sensitive process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted file within Substance 3D Designer (version 16.0.4 or earlier); the CVSS vector's UI:R and AV:L confirm this is local and interaction-dependent, so there is no remote or unauthenticated path. Limiting factors that reduce real-world risk: the attacker cannot trigger the flaw without user action, impact is confined to information disclosure (no code execution, integrity, or availability impact per I:N/A:N), and the target must be running an affected, unpatched version. There is no network exposure and no default-configuration remote vector. |
| Impact | This is a moderate-severity, low-priority issue rather than an urgent threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) describes a local, file-based attack requiring the victim to open a malicious file; it is not remotely exploitable and has no integrity or availability impact. The only serious dimension is confidentiality (C:H), reflecting disclosure of potentially sensitive process memory via an out-of-bounds read (CWE-125). No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit code identified at the time of analysis, so there are no signals of active or imminent exploitation. SSVC-style framing: exploitation status is 'none' (no public exploit), the issue is not automatable (requires per-victim social engineering to open a file), and technical impact is partial (information disclosure only). No signals conflict, but note that EPSS is absent and cannot be used to corroborate the low-urgency picture; the assessment rests on CVSS characteristics and the vendor description alone. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Designer project or asset file and delivers it to a victim through phishing, a shared project, or a downloaded asset pack. When the victim opens the file in Substance 3D Designer, the parser performs an out-of-bounds read, leaking adjacent process memory that the attacker may recover to obtain sensitive data. No public exploit code is identified at time of analysis, and the attack depends entirely on convincing the user to open the file locally. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in Adobe Substance 3D Designer 16.0.4 and earlier (CVE-2026-103825, CWE-125) can expose contents of sensitive memory when a victim opens a maliciously crafted file, resulting in information disclosure. The vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires user interaction - the attacker cannot trigger the flaw remotely and no authentication is needed per PR:N, but a crafted file must be opened by the target user. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis; EPSS/KEV data was not provided, and this is assessed as a moderate-severity, low-priority issue rather than an urgent threat.
RemediationAI
Apply the fix referenced in Adobe security bulletin APSB26-169 (https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html) - upgrade Substance 3D Designer to the vendor-designated patched release; the exact fixed version number is not specified in the supplied data, so confirm it against the bulletin before closing out. If immediate upgrade is not possible, compensating controls must target the interaction requirement that makes this exploitable: block or quarantine untrusted 3D material/project files reaching users (email attachment filtering, download sandboxing, and disallowing files from shared/untrusted repositories), which directly removes the delivery path but does not fix the underlying parser and can disrupt legitimate asset-sharing workflows; run Designer under a least-privilege account or in a restricted/sandboxed environment (AppContainer, container, or VM) so that any leaked memory is of limited value, at the cost of reduced performance and possible plugin/GPU compatibility issues; and deploy memory-protection features such as ASLR and DEP/CFG where the platform supports them, though these reduce exploitability rather than eliminating the read. Note that no public exploit code has been identified at time of analysis and no vendor patch version is independently confirmed here, so prioritization should follow the assessed moderate severity rather than emergency patching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic out-of-bounds read (CWE-125) in the file-parsing path of Adobe Substance 3D Designer, a 3D material and texture authoring tool that ingests project and material files (e.g., .sbs/.sbsar-style assets). When the application parses a malformed file, a length, offset, or index value is not validated against the bounds of an allocated buffer, so the parser reads memory past the end of the intended structure. Because the out-of-range data can be surfaced through the application or its output, this constitutes memory disclosure rather than memory corruption - there is no write primitive, which is consistent with the CVSS profile of C:H/I:N/A:N. The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U places the attack in the local, interaction-dependent class: the malicious file must be opened by the user on an affected installation, and there is no network-facing or default remote vector. The ENISA EUVD record (EUVD-2026-100705) tracks the same issue and lists affected builds as 0 through 16.0.4 and prior; tag metadata classifies it under buffer overflow and information disclosure.
Know when Substance 3d Designer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack is local via a victim-opened malicious file (AV:L, UI:R), needs no prior privileges (PR:N), and yields memory disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Substance 3d Designer
View allOut-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability t
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier via an out-of-bounds write vulnerability that trigg
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier through an out-of-bounds write vulnerability that r
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a cr
Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds writ
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability
Exploit-DB