EUVD-2026-35799
GHSA-x35f-42cm-xjh4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs through an out-of-bounds write triggered when a user opens a maliciously crafted file. The flaw executes code in the context of the current user and requires victim interaction, with no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
Substance3D Sampler is Adobe's material authoring application used to create realistic surface materials from real-world photographs for 3D content pipelines. The root cause is CWE-787 (Out-of-bounds Write), a memory corruption class where the application writes data past the bounds of an allocated buffer - typically due to flawed parsing of structured input files (material, texture, or scene formats). The affected component is identified by CPE cpe:2.3:a:adobe:substance3d_-_sampler:*:*:*:*:*:*:*:*, covering all versions up to and including 6.0.0. Successful exploitation corrupts process memory in a way that can hijack control flow, leading to arbitrary code execution under the privileges of the user running Sampler.
RemediationAI
Patch available per vendor advisory APSB26-60 (https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-60.html) - upgrade Substance3D Sampler to the version specified by Adobe in that bulletin (exact fix version not included in the input data, so confirm directly from the advisory before deploying). Until patching is complete, instruct users not to open Substance3D project, material, or texture files received from untrusted sources or downloaded from the web; route incoming creative assets through a quarantine workflow or isolated review host, accepting the workflow friction this adds to art pipelines. Application allowlisting and running Sampler under a standard (non-admin) user account limit blast radius if the flaw is triggered, since code executes in the current user context.
More in Substance3D Sampler
View allArbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted a
Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs when a victim opens a maliciousl
Arbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted 3
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today