EUVD-2026-100695
GHSA-rwqh-h926-c8vj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious asset file to victim
-
DeliveryVictim opens file in Sampler
-
ExploitOverflow stack buffer in file parser
-
ExecutionExecute arbitrary code as current user
-
ImpactCompromise user data and workstation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a malicious, attacker-crafted file in Adobe Substance 3D Sampler version 6.0.3 or earlier; it is not remotely triggerable without this action (CVSS UI:R, AV:L). There is no network-facing service to exploit - the attacker must first deliver the crafted file and rely on the user opening it locally. Code execution is limited to the privileges of the current user (S:U), so impact is scoped to that account rather than system-wide, and standard least-privilege desktop configurations limit blast radius. No special product feature or non-default configuration is required beyond the application's normal file-opening workflow. |
| Impact | This is a genuinely moderate-risk issue rather than a top-priority emergency. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack vector requiring user interaction - the victim must open a malicious file - which meaningfully constrains real-world exploitability compared to a remote, no-interaction flaw. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Signals are therefore consistent and non-conflicting: high technical impact (full C/I/A compromise in the current user's context) but gated behind user interaction and local delivery, with no evidence of active exploitation. The practical priority is driven by exposure of the affected creative-workstation population to untrusted asset files rather than by mass-exploitation risk. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D asset or project file that triggers the stack-based buffer overflow in Substance 3D Sampler and distributes it via a shared asset library, email, or a compromised marketplace. A designer opens the file, the overflow corrupts the stack, and attacker-controlled code executes in the context of the current user. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Arbitrary code execution in Adobe Substance 3D Sampler 6.0.3 and earlier is possible because a stack-based buffer overflow (CWE-121) is triggered when the application parses a specially crafted file, with any code executed inheriting the privileges of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) shows no privileges are required, but the attack is not network-reachable: the attacker must first deliver the malicious file and rely on the victim opening it in the application. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuinely moderate-risk desktop issue rather than a top-priority emergency, though the high confidentiality, integrity, and availability impact on the user's session justifies prompt patching.
RemediationAI
Adobe's security bulletin for this issue is APSB26-159 (https://www.adobe.com/trust/security/products/substance3d-sampler/apsb26-159.html); because the provided data does not specify an exact fixed build number, treat that advisory as the authoritative source for the patched version and upgrade Substance 3D Sampler beyond 6.0.3 as soon as Adobe's fixed release is available - patch availability is indicated by the vendor advisory, but the precise release number is not independently confirmed here. Until the upgrade is applied, the most effective compensating control is to avoid opening untrusted, unsolicited, or externally sourced Substance/material files in Sampler, since exploitation requires the victim to open the malicious file (UI:R) and there is no remote attack path to block; trade-off is reduced ability to exchange assets with third parties. Where such files must be handled, open them inside a disposable virtual machine, a sandbox, or a low-privilege guest account with no access to production shares or credentials - this limits blast radius to the current user (S:U) but adds processing overhead and workflow friction. Additional hardening includes running Sampler under a least-privilege desktop account, keeping OS exploit mitigations (ASLR, DEP/NX, Control Flow Guard) enabled to raise the reliability bar for stack-overflow exploitation, and configuring email/web gateways to quarantine unsolicited Sampler-related attachments. Detection-side, monitor endpoint telemetry for Sampler child-process creation, unexpected script interpreters, or outbound connections spawned from the application process, and remove or restrict the file-type association if the tool is not business-critical. Organizations should not rely on network perimeter controls here, as the vulnerability is local-trigger (AV:L) and delivered via social engineering rather than a listening service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a stack-based buffer overflow (CWE-121) in Adobe Substance 3D Sampler, a member of Adobe's Substance 3D suite used for image-based material authoring and texture processing, where imported source files and substance/material assets are parsed. A classic CWE-121 condition occurs when a fixed-size stack buffer is filled with attacker-controlled data without adequate length validation; adjacent stack memory - including saved frame pointers and return addresses - can be overwritten, letting an attacker redirect execution and run arbitrary code in the context of the current user. Because the CVSS vector is AV:L with UI:R and S:U, the flaw is reachable only after the victim opens a malicious file locally, and the resulting compromise is confined to that user's account rather than elevating to system or kernel privileges; no network-facing service is involved and no special application feature or non-default configuration is needed beyond the normal file-opening workflow. The affected range reported by ENISA EUVD is Substance 3D Sampler 0 through 6.0.3 inclusive, and the vector's C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability for that user session once exploitation succeeds.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based local delivery gives AV:L and UI:R; no prior auth needed to open a file so PR:N; reliable overflow yields AC:L and full C/I/A in the user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Sampler 6.0.3 and earlier is affected by a high-severity vulnerability that could allow an attacker to execute arbitrary code on a user's system when a specially crafted file is opened. Although no public exploit identified at time of analysis and the attack requires user interaction, successful exploitation could compromise sensitive design data and disrupt creative workflows. Security management should address this risk through interim mitigations while awaiting a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations include user awareness training on file handling, application sandboxing, restricting file execution permissions, and monitoring for anomalous application behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB