EUVD-2026-84798
GHSA-gvj5-6mc7-3xx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious model file
-
DeliveryDeliver via email or asset share
-
ExploitVictim opens file in Modeler
-
ExecutionTrigger out-of-bounds write
-
PersistCorrupt memory in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires user interaction: a victim must open an attacker-crafted malicious file in Adobe Substance3D - Modeler (per CVSS UI:R and the description). Attack vector is local (AV:L) - the malicious file must be delivered to and opened on the victim's workstation; there is no remote/network-triggered path and no listening service involved. Exploitation runs code only in the context of the current user (S:U), so impact is bounded by that user's privileges. Limiting factors: dependence on social engineering to get the file opened, the specialized and comparatively small population of Substance3D Modeler users, and the absence of any known public exploit or active-exploitation reporting. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a classic client-side file-parsing flaw: local attack vector, low complexity, no privileges, but requiring user interaction (opening a malicious file). Despite PR:N, this is NOT remotely exploitable in the network sense - the 'unauthenticated' quality only means no login is needed once the victim opens attacker-supplied content; delivery still depends on social engineering. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no evidence of active or imminent exploitation. This profile is typical of the large Adobe creative-app CVE batches (here APSB26-155): high technical impact (arbitrary code execution as the current user) but real-world risk moderated by the narrow, artist-focused user base and the required victim action. Treat as a standard-priority patch - meaningful because code execution is possible, but not an emergency absent exploitation signals. SSVC-style read: exploitation=none, automatable=no (requires human to open file), technical impact=total for the user context. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D model/project file that triggers an out-of-bounds write when parsed by Substance3D Modeler, and delivers it to a target 3D artist via email, a shared asset library, or a compromised marketplace download. When the victim opens the file, the memory corruption is leveraged to execute arbitrary code with that user's privileges. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local attack (CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) requires user interaction and is not known to be actively exploited; no public exploit code has been identified at time of analysis. The flaw affects the application's file parsing logic and could lead to full compromise of confidentiality, integrity, and availability for the current user.
RemediationAI
Apply the security update referenced in Adobe Security Advisory APSB26-155 (https://helpx.adobe.com/security/products/substance3d-modeler/apsb26-155.html); the advisory contains the exact patched versions for Substance3D Modeler. If immediate patching is not possible, mitigate risk by training users to avoid opening untrusted Substance project files, blocking file types via email and web gateways where feasible, and running the application with least privilege to limit the impact of code execution in the current user context. Disabling file preview or thumbnail generation for untrusted files may reduce exposure, but these workarounds are not substitutes for the vendor fix and may disrupt normal workflows. No public exploit is known at this time, but timely patching is still recommended.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption error that occurs when the application writes data past the end of an allocated buffer. In the context of Adobe Substance3D Modeler, a 3D modeling application, this likely arises during parsing of a crafted file format (e.g., a Substance material or model file). The CPE entry cpe:2.3:a:adobe:substance3d_-_modeler:*:*:*:*:*:*:*:* indicates that all versions of the product may be affected, though the vendor advisory should be consulted for the precise affected version range. Because the attack vector is local (AV:L) and requires user interaction (UI:R), an attacker must deliver a malicious file to the victim and convince them to open it; there is no network-reachable service involved. Successful exploitation runs code in the context of the current user (S:U), so the impact is bounded by that user's privileges, but with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H).
Know when Substance3D Modeler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open exploitation (AV:L, UI:R) with no prior privileges (PR:N); OOB write yields full code execution in the user's context, so C/I/A all High and scope Unchanged.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance3D Modeler, used by our 3D content and design teams, contains a high-severity out-of-bounds write that allows code execution under the victim's own account whenever a crafted file is opened. Because no vendor patch exists yet, every designer workstation running the affected version remains exposed through ordinary file-opening workflows, including files received from external partners or downloaded from asset libraries. Leadership should treat this as a manageable but unresolved exposure requiring immediate handling controls and a tracked patching commitment from Adobe, since a single malicious asset could compromise a user's credentials, project data, and local files.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict opening of untrusted or externally sourced Substance3D files, enforce least-privilege user accounts, enable application allowlisting and endpoint detection for suspicious child processes spawned by the application, scan and quarantine related file types at email and web gateways, and isolate the tool on dedicated or non-production systems where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Substance3D Modeler
View allOpening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the curren
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write
Exploit-DB