Substance 3D Sampler CVE-2026-48421

Exploitation requires the victim to actively open a malicious file using Adobe Substance 3D Sampler - this is the sole prerequisite confirmed by the CVSS UI:R metric and the CVE description. No network service exposure, authentication bypass, or elevated privileges are involved; the attack is entirely file-parsing-triggered. Exploitation is limited to the privilege level of the currently logged-in user (S:U, no scope change), meaning attacker code runs as the user who opened the file and does not inherently gain administrative access. The attack does not work against default configurations without this user interaction step, and remote unauthenticated network exploitation is not possible.

The CVSS 7.8 High score is well-calibrated for a file-parsing RCE: AV:L restricts the attack to the desktop context, AC:L confirms no special conditions beyond delivering the file, PR:N indicates no authentication is needed, and UI:R correctly gates exploitation on victim interaction. No EPSS data was provided in the input, and no CISA KEV listing exists, suggesting no confirmed in-the-wild exploitation at time of analysis. The practical threat model is a targeted phishing or watering-hole scenario against creative professionals (game developers, 3D artists, VFX studios), who routinely receive and open third-party asset files. The absence of a network attack vector significantly narrows opportunistic mass exploitation, but targeted delivery to a high-value user remains a realistic threat. Real-world priority is moderate: meaningful for organizations with Substance 3D Sampler deployments, lower urgency for general enterprise environments where the software is not present.

An attacker crafts a malicious Substance 3D Sampler project or asset file designed to trigger an out-of-bounds write during parsing, then delivers it to a target user via email, a file-sharing platform, or a poisoned asset repository commonly used in creative industries. When the victim opens the file in Substance 3D Sampler, the parser processes attacker-controlled data, overwriting adjacent memory and redirecting execution flow to run arbitrary code under the victim's user account. No public exploit code has been identified at time of analysis.