EUVD-2026-100697
GHSA-vvvj-5c87-gf44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D asset file to victim
-
ExploitVictim opens file in Substance 3D Sampler
-
ExecutionTrigger out-of-bounds write in file parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Substance 3D Sampler version 6.0.3 or earlier; this is the exact precondition stated in the description ('a victim must open a malicious file'). It is strictly local and client-side (AV:L): there is no network-facing service, listener, or remote trigger. The principal limiting factors are the mandatory user interaction (the artist must be induced to open the crafted asset) and the narrow deployment of this specialized creative tool, which together make opportunistic or automated exploitation impractical and favor targeted social-engineering delivery. No special product configuration or authentication is required beyond having the vulnerable version installed and running under the victim's account. |
| Impact | This is a genuine but operationally-gated client-side vulnerability rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes an out-of-bounds write (CWE-787) reached through local file parsing: the attacker has no privileges (PR:N) but cannot act remotely over a network - exploitation hinges entirely on social engineering to get a victim to open a malicious project/asset file (UI:R). All three impact metrics are High, consistent with arbitrary code execution in the current user's context. Critically, several priority signals are ABSENT from the input: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC is referenced - so there is no evidence of active or at-scale exploitation. The practical signals are therefore in tension with the HIGH base score: high technical impact but low attacker reach (local vector + mandatory user interaction + a niche creative-software install base) means real-world risk is moderate and depends on targeted delivery of a weaponized file, not mass exploitation. Treat as a standard patch-cycle priority for workstations running Substance 3D Sampler, elevated only for users who routinely open untrusted 3D assets. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D asset or project file that triggers the out-of-bounds write in Substance 3D Sampler and distributes it via email, a shared asset marketplace, or a compromised collaboration channel. A 3D artist opens the file in Substance 3D Sampler (version 6.0.3 or earlier), the malformed data corrupts memory during parsing, and attacker-controlled code executes with that user's privileges. No public exploit code is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Opening an attacker-supplied file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds write that leads to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is strictly local and client-side: there is no network-facing service to hit, and the victim must be socially engineered into opening a malicious asset in their own session. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the practical risk is bounded by the required user interaction and the specialized deployment of this creative tooling, which favors targeted delivery over opportunistic mass exploitation.
RemediationAI
Apply the fix published in Adobe security bulletin APSB26-159 (https://www.adobe.com/trust/security/products/substance3d-sampler/apsb26-159.html); patch availability is confirmed by the vendor bulletin, though the specific fixed version number is not enumerated in the provided data, so consult the advisory and the Creative Cloud/Substance updater for the exact remediated build. Until the update is applied, the most effective compensating controls target the required precondition - a user opening a malicious file: block or quarantine untrusted Substance material and sampler asset files (.sbsar and similar) at email and web gateways and via endpoint file-type controls, which removes the delivery path but will also block legitimate artist-supplied materials and requires an allow-list workflow for trusted sources; avoid opening assets from external or untrusted collaborators, and treat sample/material packs from unknown senders as hostile. Because exploitation executes in the victim's own user context, run Substance 3D Sampler under a least-privileged account and, where feasible, inside a sandboxed VM or a low-privilege workstation so that successful exploitation cannot reach production assets or credentials - this adds friction to artist workflows and is best reserved for machines handling externally sourced content. Application allow-listing and EDR behavioral monitoring of Substance 3D Sampler child processes can add detection coverage, but neither prevents the initial memory corruption, and vendor patches remain the primary remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write, in Adobe Substance 3D Sampler, a material-authoring application used with Substance 3D assets and .sbsar-style material packages. Third-party tags classify this as a buffer overflow / memory corruption issue that can escalate to remote code execution once a malformed file is parsed. Because the CVSS vector is AV:L with UI:R and PR:N, the attack surface is the file-parsing path rather than a network listener: the vulnerable code runs when the application loads attacker-controlled content, and the resulting memory corruption can be turned into code execution with the privileges of the user who opened the file. No CPE strings were supplied with this record, so the authoritative version boundary comes from the EUVD data, which lists Substance 3D Sampler versions up to and including 6.0.3 as affected; the reporting party (psirt@adobe.com) and the associated advisory APSB26-159 confirm this is an Adobe-issued product security fix. Adobe's advisory is valid at time of analysis. Note that this is a file-format parsing weakness, not a sandbox-escape or privilege-escalation primitive: exploitation yields code execution in that user's context, not at system privilege level.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L and UI:R because exploitation requires a local user to open a malicious file; PR:N as no prior privileges are needed; C/I/A:H reflect arbitrary code execution as the current user.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Sampler versions 6.0.3 and earlier are affected by a high-severity vulnerability that could allow an attacker to execute arbitrary code when a user opens a malicious file. Although no public exploit identified at time of analysis, the lack of a vendor patch means creative teams face a targeted risk that could lead to unauthorized access to sensitive project data. Leadership should prioritize mitigating this risk through user awareness and access controls.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting application use to trusted users, enforcing user awareness training to avoid opening untrusted files, deploying application sandboxing or isolation, and monitoring for suspicious file activity via EDR. Additionally, maintain heightened vigilance for vendor advisories and apply the patch as soon as it becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB