Substance 3D Sampler CVE-2026-48423

Exploitation requires that a victim user open a specially crafted file using Adobe Substance 3D Sampler - no network-exposed service, no server-side processing, and no administrative privileges are involved. The CVSS UI:R metric confirms this interaction dependency; exploitation cannot occur without the file-open action. PR:N indicates that the attacker does not need any pre-existing credentials or authenticated access to the victim's system - the malicious file is the sole delivery mechanism. Exploitation is bounded to the current user's permission context (S:U); no privilege escalation beyond the logged-in user is implied. The primary limiting factor is social engineering: the attacker must successfully deliver the file and induce the victim to open it, which is easier in creative-industry workflows where asset sharing is routine.

CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high impact with low attack complexity once user interaction is obtained, constrained by local scope and required file-open interaction. This is not a zero-configuration remote flaw - an attacker must deliver a crafted file and convince a user to open it, which is a meaningful barrier but a well-established attack path against creative-software users through shared assets, online repositories, and collaboration channels. No EPSS data was provided in the input; without it, exploitation probability cannot be quantified. KEV status is not listed, indicating no confirmed active exploitation by CISA at time of analysis. No POC has been referenced. The S:U scope constraint means a successful exploit is sandboxed to the current user's permissions - privilege escalation is not implied. Overall, this is a genuine high-severity vulnerability for the affected user population (3D artists, game developers) but not a mass-exploitation candidate given the niche software footprint and interaction requirement.

An attacker crafts a malicious Substance 3D Sampler project or texture file and distributes it through a 3D asset sharing platform, a spear-phishing email to a studio's art team, or a compromised collaboration channel. When the victim opens the file in Substance 3D Sampler, the heap overflow triggers during file parsing, redirecting execution to attacker-controlled shellcode and running arbitrary commands with the victim user's OS privileges. No public POC has been identified at time of analysis, but the attack pattern is consistent with well-understood heap exploitation techniques.