EUVD-2026-35797
GHSA-rf65-6wmx-8w67
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted 3D asset file, triggering an out-of-bounds write that runs attacker code with the current user's privileges. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the local attack vector combined with high impact and required user interaction makes this a classic targeted-phishing/social-engineering risk against artists and 3D designers.
Technical ContextAI
Substance3D Sampler is Adobe's material authoring tool used by 3D artists to create physically-based materials from scans and photographs, parsing a wide range of image, mesh, and material file formats. CWE-787 (Out-of-bounds Write) indicates that the file parser writes data past the bounds of an allocated buffer, corrupting adjacent heap or stack memory; in a parser that processes attacker-supplied binary file structures, this class of bug is routinely converted to control-flow hijacking and arbitrary code execution. The CPE cpe:2.3:a:adobe:substance3d_-_sampler:*:*:*:*:*:*:*:* covers the Adobe Substance3D Sampler product across platforms, and the description scopes the defect to version 6.0.0 and earlier.
RemediationAI
Patch available per vendor advisory: upgrade Substance3D Sampler to the fixed version listed in Adobe security bulletin APSB26-60 (https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-60.html) - the bulletin should be consulted directly for the exact fixed build, which was not enumerated in the input data. Until updated, instruct users not to open Substance3D project files, scans, or material packages received from untrusted sources or unsolicited email, and consider restricting Sampler's ability to open files from network shares or downloaded-from-internet locations via Mark-of-the-Web/Gatekeeper enforcement; the trade-off is workflow friction for artists who routinely ingest external assets. Endpoint EDR rules that alert on Sampler spawning shells, PowerShell, or scripting hosts provide useful detection coverage with minimal operational impact.
More in Substance3D Sampler
View allArbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted a
Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs through an out-of-bounds write t
Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs when a victim opens a maliciousl
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today