Substance 3D Sampler CVE-2026-48422

Exploitation requires the victim to actively open a malicious file using Substance 3D Sampler - this is the sole prerequisite, as reflected in the CVSS UI:R metric. The attacker does not need any privileges on the target system (PR:N), nor does the application need to be running in any specific configuration. The attack vector is local (AV:L), meaning the malicious file must be accessible on the victim's machine or network-accessible file system; the attacker cannot exploit this remotely without first delivering the file. Limiting factors include: the requirement for user interaction (the victim must be socially engineered or otherwise induced to open the file), and the local attack vector (no direct network-reachable exploitation path). Default installations of Substance 3D Sampler are vulnerable - no special feature or configuration setting is required to trigger the flaw beyond normal file-open operations.

The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the risk profile: the attack vector is local (the malicious file must be opened on the victim's machine), complexity is low once the file is delivered, and no attacker privileges are required on the target system - only the victim's interaction. The full C:H/I:H/A:H triad reflects complete code execution capability in the user's context. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, so widespread or opportunistic exploitation has not been confirmed. POC code is also not publicly known at time of analysis. The practical risk is moderate-to-elevated for organizations in creative, media, game development, or industrial design verticals where Substance 3D Sampler is actively used - targeted spear-phishing or malicious asset delivery via supply chains (e.g., 3D asset marketplaces) are realistic vectors. The absence of KEV listing and POC lowers urgency compared to network-exploitable vulnerabilities, but the low attack complexity once a file is opened means this should be patched promptly. SSVC framing: exploitation status is none confirmed, automatable is no (requires per-victim file delivery and interaction), technical impact is total - making this a 'scheduled' or 'urgent' priority depending on user base exposure.

An attacker crafts a malicious 3D asset file (e.g., a texture or material file in a format parsed by Substance 3D Sampler) designed to trigger the heap buffer overflow during parsing. The file is delivered to a creative professional or game developer via a spear-phishing email, a compromised 3D asset marketplace, or a shared project repository. When the victim opens the file in Substance 3D Sampler, the overflow is triggered and the attacker achieves arbitrary code execution in the context of that user's session. No public exploit code exists at time of analysis, so this scenario currently requires custom exploit development.