EUVD-2026-29746
GHSA-64j8-r85v-7v9f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open exploitation means AV:L and UI:R; no prior privileges needed (PR:N), and code execution as the user yields full C:H/I:H/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
5DescriptionCVE.org
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance3D - Designer versions 15.1.0 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted asset or project file, running attacker code in the context of the current user. The flaw was reported by Adobe and patched in advisory APSB26-52; there is no public exploit identified at time of analysis and EPSS is very low (0.03%, 8th percentile). SSVC records no known exploitation, but the technical impact is rated total.
Technical ContextAI
Substance3D - Designer is Adobe's node-based procedural material and texture authoring application used in 3D content creation pipelines. The vulnerability is a CWE-787 out-of-bounds write, a memory-corruption class where the application writes past the bounds of an allocated buffer - typically while parsing a malformed file format (mesh, texture, or Substance project asset). Corrupting adjacent heap or stack memory can overwrite control data (function pointers, return addresses) and be leveraged for arbitrary code execution. The single affected CPE is cpe:2.3:a:adobe:substance3d_-_designer, and the tags (Memory Corruption, Buffer Overflow, RCE) reinforce that this is a file-parsing memory-safety defect rather than a network-facing service flaw.
RemediationAI
Upgrade Substance3D - Designer to the fixed release published in Adobe advisory APSB26-52 (https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html); the input data confirms a patch is available per the vendor advisory but does not enumerate the exact fixed version string, so consult APSB26-52 for the specific build to install (do not rely on any assumed version number). Until patched, reduce exposure by only opening Substance project and asset files from trusted sources, treating downloaded or emailed 3D assets and materials as untrusted, and where feasible opening unknown files on an isolated or sandboxed workstation to contain any code execution. These are behavioral controls with the trade-off of slowing artist workflows; there is no configuration toggle that disables the vulnerable file-parsing path, so upgrading is the only durable fix.
More in Substance3D Designer
View allArbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds writ
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds writ
Arbitrary code execution in Adobe Substance3D - Designer 15.1.0 and earlier occurs when a victim opens a maliciously cra
Path traversal in Adobe Substance3D Designer 15.1.0 and earlier enables arbitrary file system reads when a victim opens
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today