What is the CVSS score of EUVD-2026-29742?

EUVD-2026-29742 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Substance3D Designer EUVD-2026-29742

| CVE-2026-34664 MEDIUM

Path Traversal (CWE-22)

2026-05-12 adobe

GHSA-r2h3-cfxv-h42g

Path Traversal Adobe Substance3D Designer

6.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.3 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

6.3 MEDIUM

AV:L because exploitation requires local file delivery and victim interaction; S:C because reads escape application boundary; I:N and A:N confirmed by description (read-only impact).

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:23 vuln.today

CVE Published

May 12, 2026 - 18:13 nvd

MEDIUM 6.3

DescriptionCVE.org

Substance3D - Designer versions 15.1.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Path traversal in Adobe Substance3D Designer 15.1.0 and earlier enables arbitrary file system reads when a victim opens a specially crafted malicious file. The vulnerability carries a scope change - the attacker can read files and directories outside the application's own data boundaries, potentially exposing OS-level sensitive content. No public exploit has been identified at time of analysis, EPSS sits at 0.02% (5th percentile), and CISA SSVC rates exploitation as none with non-automatable delivery, indicating limited real-world threat momentum despite the High confidentiality impact rating.

Technical ContextAI

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes a failure to sanitize user-controlled path components before using them in file system operations. In Substance3D Designer, a purpose-built 3D material authoring application by Adobe, project or asset files are parsed locally by the application. If path components within such files are not normalized or validated, an attacker-controlled sequence such as '../../../etc/passwd' can escape the intended working directory and direct the application to read arbitrary OS-level files. The CPE string (cpe:2.3:a:adobe:substance3d_-_designer:*:*:*:*:*:*:*:*) confirms all versions up through 15.1.0 are in scope. The CVSS scope flag S:C reflects that the read access escapes the application's own security boundary into the broader file system.

RemediationAI

Consult Adobe Security Bulletin APSB26-52 at https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html for the patched release version; the exact fixed version number is not present in the provided intelligence data and should be confirmed directly from the advisory before deploying updates. Users should upgrade Substance3D Designer to the version specified in APSB26-52 at the earliest opportunity. As an interim workaround, avoid opening Substance3D Designer project files received from untrusted or unverified sources; implement file-origin controls in content pipelines (e.g., quarantine and review asset files from external collaborators before local execution). Disabling auto-open behaviors in OS file associations reduces accidental exposure. These controls carry the trade-off of workflow friction in studios that exchange assets frequently.