Substance 3D Designer CVE-2026-103827

Exploitation requires a victim running Adobe Substance 3D Designer (version ≤16.0.4) to open an attacker-supplied malicious file within the application; there is no remote, network, or unauthenticated service-facing exploitation path. Limiting factors: the attack vector is local (AV:L), mandatory user interaction is required (UI:R - the victim must actively open the crafted file), and impact is confined to availability (application crash/DoS) with no confidentiality or integrity effect. This means successful exploitation depends entirely on social engineering to induce file opening, and the payoff is limited to disrupting the artist's session rather than compromising data or the host.

This is a genuine but comparatively low-priority issue. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, file-based attack with no confidentiality or integrity impact - only availability (an application crash). The UI:R requirement (victim must open a malicious file) and local attack vector substantially cap real-world risk, as exploitation cannot be performed remotely or automatically against exposed services. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The only consequence is denial-of-service (crash); there is no indication of code execution despite the stack-based buffer overflow (CWE-121) root cause - Adobe scoped impact to A:H / C:N / I:N, meaning memory-safety exploitation for RCE was either not demonstrated or not achievable. Net: a legitimate vulnerability worth patching in the normal cycle, not an emergency. Note the signals are internally consistent (local vector + user interaction + availability-only), so there is no conflicting data to flag here, though the absence of EPSS limits probabilistic risk ranking.

An attacker crafts a malicious Substance 3D Designer project or material/asset file and delivers it to a 3D artist via email, a shared asset library, or a download, relying on social engineering. When the victim opens the file in a vulnerable version (≤16.0.4), a stack-based buffer overflow is triggered and the application crashes, interrupting the user's work. No public exploit code is identified at time of analysis, and the flaw yields only denial-of-service, not code execution.