EUVD-2026-84796
GHSA-hjqg-73v6-fq62
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious 3D file
-
DeliveryDeliver file to victim
-
ExploitVictim opens file in Modeler
-
ExecutionOverflow parser stack buffer
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local user interaction: a victim must open a maliciously crafted file in Adobe Substance3D - Modeler (per CVSS UI:R and AV:L). No authentication or prior privilege is needed on the attacker's side (PR:N), but the attacker cannot trigger the bug remotely or without the victim's action - there is no network-facing exposure. Limiting factors: the requirement for social engineering to get the file opened, execution being confined to the current user's context (S:U, no privilege escalation), and the small, specialized installed base of the Modeler application. |
| Impact | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a client-side file-parsing memory-corruption bug, not a remotely reachable service flaw: the Local attack vector plus UI:R means an attacker cannot trigger it over the network - a victim must be socially engineered into opening a malicious file in Substance3D Modeler. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Signals are consistent rather than conflicting: the high subscores (C:H/I:H/A:H) stem from arbitrary code execution in the current user's context, but the practical risk is gated by the user-interaction requirement and the narrow, professional user base of the product. Stack-based overflows (CWE-121) are historically exploitable, yet developing a reliable exploit against a specific file format still takes effort and there is no evidence of active targeting. Net: a legitimately high-severity RCE but a moderate real-world priority - patch on a normal cadence, prioritized above network-unreachable informational bugs but below unauthenticated remote or actively-exploited flaws. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D asset/project file that triggers a stack-based buffer overflow in Substance3D Modeler's file parser and delivers it to a victim (email, shared project, download). When the victim opens the file, the overflow overwrites the stack and executes attacker-controlled code with the victim's privileges. No public exploit code is identified at time of analysis, and successful exploitation depends entirely on the user opening the crafted file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Opening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an attacker execute arbitrary code in the context of the current user. The flaw is client-side and local in nature - there is no network-facing exposure - so exploitation depends on social engineering to convince a victim to open a poisoned file, and any code that runs inherits only that user's privileges (no privilege escalation). The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) matches that assessment: high confidentiality and integrity impact, but gated behind the requirement that the user opens the file; no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Apply the fixed release of Adobe Substance 3D Modeler documented in Adobe's security bulletin APSB26-155 (https://helpx.adobe.com/security/products/substance3d-modeler/apsb26-155.html); patch availability is confirmed through that vendor advisory, though an exact patched version number is not provided in the source data, so the bulletin's version guidance should be followed precisely. Until updating, reduce exposure by treating all Substance 3D Modeler project and asset files from untrusted or external sources as hostile: do not open files received by email, chat, or download from unknown parties, and validate file provenance before opening - the trade-off is that this blocks legitimate shared assets and requires a manual review step. Additional compensating controls include running Modeler under a low-privilege account with no access to sensitive local data or network shares (limits post-exploitation blast radius but does not prevent the crash), tightening macro/attachment filtering and web download controls at the email and proxy layer to keep malicious modeling files off endpoints, and relying on endpoint detection for child-process creation from the Modeler executable. Because the attack requires the victim to open a file locally, disabling or restricting file-type association for Modeler on hosts that do not need it removes the attack surface entirely, at the cost of blocking that workflow.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stack-based buffer overflow (CWE-121) in Adobe's Substance 3D Modeler, a desktop tool for authoring procedural 3D materials and models. CWE-121 describes unbounded or misvalidated copy operations into a fixed-size stack buffer during parsing of attacker-controlled input; here that input arrives through a user-opened file rather than over a socket, which is why the CVSS vector is local (AV:L) with user interaction (UI:R). The supplied CPE, cpe:2.3:a:adobe:substance3d_-_modeler:*:*:*:*:*:*:*:*, uses a wildcard version, meaning the advisory does not restrict the flaw to a published version window in the data available, so any build of Substance 3D Modeler listed in Adobe's APSB26-155 bulletin should be treated as potentially affected until the fixed release is applied. Because the overflow occurs in the file-parsing path executed under the invoking user's account (PR:N, S:U), a successful exploit corrupts stack memory to hijack control flow and run code with the victim's permissions rather than SYSTEM/root, and it cannot be triggered remotely or without the victim's action.
Know when Substance3D Modeler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector (AV:L) with required victim interaction (UI:R) and no attacker privileges (PR:N); arbitrary code execution as current user yields full C:H/I:H/A:H, no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
A high-severity memory corruption flaw in Adobe Substance 3D Modeler allows arbitrary code execution with the privileges of the user who opens a maliciously crafted file, which could put design and 3D content teams at risk. The vulnerability is local-only and requires a victim to be socially engineered into opening a poisoned file, so it is not remotely exploitable, but successful exploitation could expose or corrupt sensitive creative assets and any data the affected user can access. No vendor patch and no public exploit were identified at the time of analysis, meaning the exposure persists until Adobe releases a fix and the organization should rely on interim controls.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege so users run Substance 3D Modeler as standard (non-administrator) accounts to limit the impact of any code execution; restrict ingestion of externally sourced or untrusted project files and quarantine suspicious attachments at email and web gateways; deploy endpoint detection and response with application allowlisting to detect and block anomalous child processes spawned by the application; and provide user awareness guidance on the social-engineering risk of opening unsolicited files. Apply Adobe's vendor patch as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Substance3D Modeler
View allOut-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the curren
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write
Exploit-DB