EUVD-2026-84797
GHSA-p5mm-8379-wm32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Modeler asset file
-
DeliveryDeliver via email or asset share
-
ExploitVictim opens file in Substance3D Modeler
-
ExecutionOut-of-bounds write corrupts memory
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted malicious file in Adobe Substance3D - Modeler; the OOB write is triggered during file/asset parsing. Limiting factors: attack is local (AV:L) and requires user interaction (UI:R) - there is no remote or network-triggerable path and no automatic/drive-by execution. Code runs only in the context of the current user (S:U), so impact is bounded by that user's privileges rather than yielding SYSTEM/root. No special product configuration or feature toggle is required beyond having the affected Modeler version installed and the user being willing to open the file. |
| Impact | This is a genuine but lower-priority-than-headline-number issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) reflects arbitrary code execution, but the AV:L plus UI:R combination is the real story: this is NOT a remotely-triggerable network flaw. Despite PR:N (no prior authentication), exploitation is entirely dependent on social-engineering a victim into opening a malicious file locally, which meaningfully caps automatability and scale. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - treat active-exploitation as unconfirmed. There is no signal conflict in the data: the CVSS local vector is consistent with the description's 'victim must open a malicious file' language. The main caveat is that C:H/I:H/A:H code execution runs only in the context of the current user, not SYSTEM/root, so blast radius is bounded by that user's privileges. Net: patch on a normal cycle for workstations running this software; it is not an emergency internet-facing exposure. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance3D Modeler project/asset file with a malformed structure that triggers an out-of-bounds write during parsing, then delivers it via email, a shared asset library, or a compromised marketplace download. A 3D artist opens the file in Modeler, the OOB write corrupts memory, and attacker-controlled code executes in the context of that user. No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file in the application. The flaw is triggered during parsing of a malicious asset, so exploitation is local and requires user interaction: there is no network-reachable or drive-by path, and no public exploit code has been identified at time of analysis. With a CVSS base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no CISA KEV listing, this is a genuine but lower-priority-than-the-headline-number memory-corruption bug whose real-world impact is bounded by the privileges of the user who opens the file.
RemediationAI
Apply the fixed build of Adobe Substance3D Modeler identified in Adobe security bulletin APSB26-155 (https://helpx.adobe.com/security/products/substance3d-modeler/apsb26-155.html); patch availability is confirmed by the vendor advisory, but an exact patched version number is not present in the supplied data and must be read from that bulletin before upgrading. Until the update is applied, the highest-value compensating control is to treat untrusted 3D asset files as executable content: block or quarantine Modeler files arriving from email, web downloads and shared drives, and require users to open only assets from vetted internal sources - the trade-off is a workflow restriction on review of externally supplied models. Where the business must handle third-party assets, open them on an isolated workstation or in a sandboxed/low-privilege user account so that any code execution is contained to a disposable, non-privileged context, accepting the cost of extra hardware or virtualization overhead. Endpoint detection and response rules that flag Modeler spawning child processes, writing to unusual paths, or making outbound connections after a file open provide detection coverage without blocking legitimate work, and application allowlisting of the approved patched binary prevents users from running a still-vulnerable copy; note that these are detective or restrictive measures and do not remove the underlying memory-corruption flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a CWE-787 out-of-bounds write, a memory-corruption class in which a buffer length or index calculation is not validated before data is written, allowing an attacker-controlled write past the end of an allocated buffer. In Substance3D Modeler the write occurs while the application parses an attacker-supplied asset file, and because the corruption is attacker-shaped, it can be leveraged to hijack control flow and run code at the privilege level of the Modeler process (CVSS scope is Unchanged, so impact stays within the current user's security context). The affected product is identified by the CPE cpe:2.3:a:adobe:substance3d_-_modeler:*:*:*:*:*:*:*:*, i.e. all enumerated versions of Adobe Substance3D Modeler are in scope since no version bounds are published in the CPE string. The CVSS vector confirms AV:L (local attack vector) and UI:R (victim must open the malicious file), with PR:N indicating no prior authentication or credentials are needed once the user is induced to open the document.
Know when Substance3D Modeler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open RCE: AV:L and UI:R because a victim must open a malicious file, PR:N since no prior auth is needed, C/I/A:H for arbitrary code execution as the current user.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Modeler contains a memory-corruption flaw that can allow code execution on the workstation of any employee who opens a maliciously crafted 3D asset file. The risk is confined to individual users who deliberately open an untrusted file - there is no network-reachable or drive-by attack path, and any compromise is limited to that user's own permissions. Because no vendor patch is currently available, leadership should treat this as a manageable but unresolved exposure requiring interim controls and asset-handling discipline rather than emergency remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: prohibit opening untrusted or externally sourced asset files in Adobe Substance 3D Modeler; restrict ingestion to vetted internal or supplier-provided content; run the application with least privilege (no local administrator rights) so code execution is bounded by user context; enable EDR monitoring and alerting on Substance 3D Modeler process behavior; consider sandboxing, containerizing, or isolating the application on dedicated workstations for high-risk asset review; and subscribe to Adobe PSIRT advisories to apply the vendor fix immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Substance3D Modeler
View allOpening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an
Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write
Exploit-DB