Substance 3D Designer CVE-2026-48427

Exploitation requires the victim to actively open a malicious file within Adobe Substance 3D Designer - this is the sole, non-negotiable prerequisite. The CVSS PR:N metric confirms no authentication to the software is required on the attacker's part; however, the attacker must successfully deliver the file to a system with Designer installed and induce the user to open it. No special product configuration or non-default feature flag is required - the vulnerability resides in the core file-parsing functionality invoked on any file open operation. Exploitation is bounded by: (1) user interaction - passive receipt of the file is insufficient; (2) the target must have an affected version of Substance 3D Designer installed; and (3) code execution is limited to the current user's privilege level, not SYSTEM or root, which constrains post-exploitation lateral movement without a privilege escalation chained exploit.

The CVSS 7.8 High score is driven by the C:H/I:H/A:H impact triad, reflecting full user-context code execution once triggered. The attack complexity is low (AC:L) and no prior authentication is required (PR:N), but user interaction is mandatory (UI:R) - the victim must actively open a malicious file, which meaningfully constrains mass exploitation. The local attack vector (AV:L) is consistent with the file-open delivery model. No EPSS score was provided, making probabilistic exploitation forecasting unavailable. The absence of a KEV listing and no reported POC suggests this has not been operationalized at scale. Real-world risk is moderate: the threat model is targeted spear-phishing or malicious file sharing against 3D content creators, not opportunistic mass scanning. The low deployment prevalence of Substance 3D Designer in enterprise environments further limits exposure breadth.

An attacker crafts a malicious .sbs or .sbsar file containing data designed to trigger an out-of-bounds write in Substance 3D Designer's file parser, then delivers it to a target via email attachment, a shared asset repository, or a compromised project pipeline. When the victim opens the file in Designer, the memory corruption flaw fires and the attacker's shellcode executes with the same privileges as the victim user. No public exploit code has been identified at time of analysis, but the file-based delivery model is standard in creative-industry targeted attacks.