Substance 3D Sampler CVE-2026-48417

Exploitation requires the victim to actively open a specially crafted file in Adobe Substance 3D Sampler - the UI:R CVSS metric confirms this as a hard prerequisite. The attacker requires no prior authentication or system privileges (PR:N); the malicious file is the sole exploitation vehicle. The local attack vector (AV:L) means the attacker must first deliver the file to the victim's system through a separate channel such as email, instant messaging, file-sharing services, or a compromised asset marketplace - the vulnerability itself provides no network-reachable attack surface. Exploitation is bounded to the logged-in user's context (S:U), preventing automatic privilege escalation beyond that session. Non-default configurations are not required; any user with a vulnerable version who opens a crafted file is at risk.

The CVSS 7.8 High score with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects a file-delivery exploitation model: the attacker requires no prior privileges (PR:N) but is limited to local attack vector (AV:L), meaning exploitation occurs entirely on the victim's machine after file delivery. The UI:R requirement - victim must open a malicious file - reduces opportunistic risk compared to network-exploitable or drive-by vulnerabilities but is realistic in creative-industry workflows where sharing asset files is common. No EPSS data, CISA KEV listing, or POC code is present in available intelligence, indicating this is not currently widely exploited. The S:U (unchanged scope) means exploitation does not pivot to additional systems automatically, capping blast radius to the victim's user session. Despite the absence of active exploitation signals, the AC:L metric means no special race condition or complex configuration is required once the file is opened - successful exploitation is relatively reliable for a capable attacker.

An attacker crafts a malicious Substance 3D Sampler asset file engineered to overflow a stack buffer during the application's file parsing routine. The file is distributed to a targeted 3D artist or designer via phishing, a compromised asset-sharing platform, or embedded in a 3D asset package through a supply-chain-adjacent delivery method. When the victim opens the file in Substance 3D Sampler, the stack overflow corrupts the call stack and redirects execution to attacker-controlled code, achieving full code execution under the victim's user account. No public POC has been identified at time of analysis.