Substance 3D Designer CVE-2026-48426

Exploitation requires that the victim actively open a malicious file using Adobe Substance 3D Designer - this is the sole prerequisite user interaction. The CVSS PR:N rating confirms no prior account, session token, or privilege on the target machine is required of the attacker. The AV:L (local) attack vector means the malicious file must be present on or delivered to the victim's local filesystem; no remotely accessible network service in Substance 3D Designer is exploited. Exploitation is therefore limited by the attacker's ability to deliver the crafted file and persuade the victim to open it, and by the requirement that Substance 3D Designer be installed and used on the target host. The scope is constrained to the current user's session (S:U), meaning privilege escalation beyond the victim's own account requires additional, separate exploitation steps.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a file-borne, user-triggered attack of low complexity that delivers full user-level code execution - a pattern consistent with a well-crafted spear-phishing or watering-hole scenario. Attack complexity is genuinely low once the file is opened, as no memory layout randomization bypass or race condition is documented. The PR:N rating is appropriate: while a victim must be socially engineered, no pre-existing account or privilege on the target system is required of the attacker. EPSS data was not supplied, so exploitation probability cannot be quantified independently; however, the absence of KEV listing and no identified public POC suggests exploitation remains opportunistic rather than widespread at this time. The S:U (scope unchanged) rating confirms the blast radius is confined to the current user's session, limiting lateral movement potential without further post-exploitation steps. Overall, this is a credible priority for organizations where creative, game development, or VFX personnel routinely open externally sourced Substance 3D Designer project files.

An attacker crafts a malicious Substance 3D Designer project file and delivers it to a target creative professional via a phishing email, a compromised asset-sharing platform, or a poisoned community resource site. When the victim opens the file in Designer, the out-of-bounds write is triggered during file parsing, corrupting heap or stack memory in a way that redirects execution to attacker-controlled code running under the victim's user account. No public POC has been identified, but the low attack complexity rating indicates that a functional exploit would not require advanced techniques once the file-parsing vulnerability site is located.