EUVD-2026-65646
GHSA-g68j-gqmw-f6xw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Substance3D material file
-
DeliveryDeliver file via phishing, shared repository, or compromised asset source
-
ExploitVictim opens file in Substance 3D Sampler
-
ExecutionHeap-based buffer overflow triggered in file parser
-
ImpactArbitrary code executed as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open a specially crafted file using Adobe Substance 3D Sampler - this is confirmed by the description and reflected in CVSS UI:R. No authentication to a remote service or special server-side configuration is required; the vulnerability is entirely within the local file-parsing logic. CVSS AV:L confirms the attack is triggered locally on the victim's machine rather than over a network. The primary limiting factor is user interaction: an attacker cannot exploit this remotely without first successfully delivering the malicious file and convincing the user to open it in Substance 3D Sampler. No non-default configuration setting or specific feature toggle is identified as a prerequisite - the vulnerability is present in the default file-opening workflow. |
| Impact | The CVSS 7.8 score is consistent with a local, user-interaction-required file-parsing vulnerability with full code execution impact (C:H/I:H/A:H). The AV:L vector correctly reflects that exploitation requires the victim to open a file on their own system, reducing automated exploitation potential. No EPSS data was provided in the input, and no KEV listing or public POC is confirmed, meaning exploitation probability for opportunistic attackers is currently lower than for network-exploitable vulnerabilities. However, Substance 3D Sampler targets professional creative environments - users routinely exchange project files, making social-engineering-based file delivery realistic. The primary risk is targeted or supply-chain-adjacent attacks against design studios, game developers, or VFX pipelines where file sharing is standard workflow. The absence of POC or KEV listing should not lower guard for organizations in these verticals. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Sampler project or material file embedding a heap overflow trigger in its parsed content, then delivers it to a target designer or 3D artist via email, a shared asset repository, or a compromised asset marketplace. When the victim opens the file within the application, the overflow corrupts heap memory, enabling the attacker to redirect execution and run arbitrary code with the victim's user-level permissions on the host system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted malicious file. The attack surface is local - an attacker must deliver and persuade a target to open a weaponized file, a pattern consistent with spear-phishing or watering-hole distribution targeting creative professionals. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the update detailed in Adobe Security Bulletin APSB26-121 at https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-121.html. The input data does not include an exact patched version number, so the advisory must be consulted directly to identify the target version. Until patching is complete, reduce exposure by instructing users not to open Substance 3D Sampler files from untrusted or unverified sources. Where feasible, implement file-type sandboxing or open suspicious files in an isolated virtual machine. Email and collaboration platform controls that flag or quarantine unfamiliar 3D material file formats can reduce delivery surface. Be aware that workflow restrictions may impact productivity for creative teams who routinely exchange assets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Substance 3D Sampler is a material and texture creation application targeting 3D artists and designers in gaming, VFX, and product visualization workflows. The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), meaning the application writes beyond the boundary of a heap-allocated memory region during file parsing, corrupting adjacent heap metadata or data. This class of flaw is well-understood and frequently exploitable for arbitrary code execution when heap layout can be influenced by the malicious file's content. The affected scope per CPE (cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:*) covers all tracked versions with no version bound specified, indicating broad version exposure. The vulnerability is confirmed by Adobe via security bulletin APSB26-121.
Know when Adobe Substance 3D Sampler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing trigger requires local UI:R; no system privileges needed to open a file; full code execution yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Sampler (CVE-2026-48425, CVSS 7.8) contains a critical heap-based buffer overflow vulnerability enabling arbitrary code execution when users open specially crafted files. No public exploit has been identified at time of analysis, but the threat remains significant due to the local attack surface and absence of a vendor patch. Creative professionals and design teams face direct compromise risk through malicious files delivered via phishing or compromised file-sharing services.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting or disabling Substance 3D Sampler access until patch availability; deploying endpoint detection and response (EDR) to monitor for suspicious process execution; implementing file-scanning and sandboxing for files destined for this application; conducting user awareness training on risks of opening design files from external sources; applying application whitelisting to limit unexpected process execution; and isolating affected systems from administrative privileges where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Substance 3D Sampler
View allHeap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the victim u
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the authenti
Stack-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution under the privileges of the cu
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's secu
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the current use
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution at the privilege level of the logged-
Out-of-bounds write (CWE-787) in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the a
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution in the current user's context when a
Out-of-bounds write in Adobe Substance 3D Sampler (all versions per CPE) enables arbitrary code execution under the vict
Exploit-DB