EUVD-2026-100699
GHSA-jcf7-grqp-88fm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious Substance 3D file to victim
-
DeliveryVictim opens file in Designer
-
ExploitTrigger out-of-bounds write in parser
-
ExecutionExecute arbitrary code as current user
-
ImpactCompromise user data and session
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim running Adobe Substance 3D Designer (version 16.0.4 or prior) opens an attacker-supplied malicious file in the application; this user-interaction requirement (UI:R) is the primary limiting factor. The flaw executes code only in the context of the current user (S:U, no privilege escalation), and the Local attack vector (AV:L) means there is no remote or network-triggered path - the attacker must get the crafted file onto the victim's system and induce them to open it. No special non-default configuration is indicated by the advisory; the limiting factors are the social-engineering step and the need for the vulnerable version to be installed. |
| Impact | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R) reflects a locally-triggered memory-corruption flaw, not a remotely-reachable server bug - the 'Local' attack vector plus required user interaction (UI:R, victim must open a malicious file) means this is not a wormable or mass-exploitable issue despite the HIGH C/I/A impacts. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV; there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Weighing these signals together, this is a classic client-side 'open-a-malicious-file' arbitrary-code-execution bug: genuinely serious where the product is used to process untrusted asset files, but dependent on social engineering rather than autonomous exploitation. It is a moderate-to-high patch priority for organizations running Substance 3D Designer in creative/content pipelines, but lower urgency than a network-facing unauthenticated RCE. Note: the vector's PR:N is consistent with the description (no authentication to the tool is required beyond the user running it), and AV:L is consistent with 'open a malicious file' - these signals agree, so no vector/description conflict is present. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Designer project or asset file and delivers it to a 3D artist via email, a shared asset library, or a compromised marketplace download. When the victim opens the file, an out-of-bounds write (CWE-787) corrupts memory and executes arbitrary code in the context of the current user. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.
RemediationAI
The primary fix is to upgrade Adobe Substance 3D Designer to the patched build published in Adobe security bulletin APSB26-169 (https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html); no specific fixed version number is confirmed in the supplied intelligence, so the exact patched release should be taken from that advisory rather than assumed. Until the upgrade is applied, the decisive control is to prevent the crafted-file delivery and open step: block or quarantine untrusted Substance project and material assets at email and web gateways and via endpoint file-type filtering, and prohibit users from opening assets sourced from outside the organisation (trade-off: legitimate third-party asset exchange and marketplace downloads must be routed through a trusted review workflow). Run Designer as a standard, non-administrative account and, where feasible, inside an OS sandbox or a dedicated disposable VM when handling untrusted content, which limits the blast radius because code executes only with the current user's rights (trade-off: reduced access to local resources, licensing or GPU acceleration issues, and extra operational overhead). Patching remains necessary since these controls only reduce, not eliminate, the exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-787 (out-of-bounds write), a memory-corruption condition in the native code that parses file input, which the vendor advisory groups under RCE, buffer overflow and memory corruption tags. Because writes escape the bounds of an allocated buffer, an attacker who controls the parsed data can corrupt adjacent memory and redirect execution, yielding code execution in the context of the current user; the scope is unchanged (S:U), so no elevation to system or other-user privileges is gained. The assessed vector is local (AV:L) with low attack complexity (AC:L), no privileges required (PR:N) and required user interaction (UI:R) - the attacker needs the file placed on the victim's machine and the victim to open it, and there is no network-reachable or pre-authentication trigger path. No special non-default configuration is required per the advisory. The provided intelligence contains no CPE strings; the affected range comes from the EUVD record (Substance 3D Designer 0 and versions through 16.0.4 and prior) and the vendor advisory at the Adobe Substance 3D Designer security page (apsb26-169).
Know when Substance 3d Designer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File is opened locally so AV:L; no authentication to the app is needed (PR:N) but the victim must open a malicious file (UI:R); memory-corruption RCE yields full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
A high-severity memory-safety flaw in Adobe Substance 3D Designer 16.0.4 and earlier allows an attacker to run arbitrary code with the privileges of any user who opens a crafted asset file, which places our 3D content artists and their workstations at risk. Because exploitation requires a user to open a malicious file delivered from outside the organization, the practical threat is targeted social engineering against creative staff rather than broad network compromise, but a single successful open could hand an intruder full access to that user's files, credentials and connected production resources. With no vendor patch available, leadership should treat this as an unmitigated exposure in the content-production pipeline that warrants interim controls until Adobe ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and vet all externally sourced 3D asset files, open untrusted assets only in an isolated/sandboxed or non-networked workstation, enforce least privilege for design users, maintain behavioral endpoint detection, and monitor Adobe advisory APSB26-169 for the fixed release; the flaw is unauthenticated (CVSS PR:N) but requires the victim to open a crafted file (UI:R).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Substance 3d Designer
View allSubstance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability t
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier via an out-of-bounds write vulnerability that trigg
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier through an out-of-bounds write vulnerability that r
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a cr
Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds writ
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability
Adobe Substance 3D Designer version 12.4.0 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability that
Exploit-DB