EUVD-2026-29743
GHSA-cj53-g428-7h39
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no prior privileges (PR:N); memory corruption yields full code execution as the user, so C/I/A are all High.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance3D - Designer 15.1.0 and earlier occurs when a victim opens a maliciously crafted asset file, triggering an out-of-bounds write in the application's file parser and running attacker code with the current user's privileges. Adobe self-reported the flaw; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 7th percentile), consistent with SSVC's assessment of no observed exploitation.
Technical ContextAI
Substance3D - Designer is Adobe's node-based procedural texturing and material-authoring tool used in game development, VFX, and 3D design pipelines. The vulnerability is a CWE-787 out-of-bounds write: while parsing a malformed 3D/material asset file, the application writes past the bounds of an allocated buffer (a memory-corruption/buffer-overflow class issue per the supplied tags), allowing an attacker to corrupt adjacent memory and hijack control flow. The affected CPE is cpe:2.3:a:adobe:substance3d_-_designer, and because desktop file-parsing bugs of this class process untrusted content supplied as a file, the corruption occurs entirely within the local process handling the opened document.
RemediationAI
Upgrade Substance3D - Designer to the fixed release published in Adobe security bulletin APSB26-52 (https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html) - Patch available per vendor advisory; consult the bulletin for the exact patched version, which is not restated in the provided data and should not be assumed or invented. Until patched, the primary compensating control is to treat Substance3D asset/project files from untrusted or unverified sources as dangerous: do not open files received via email, download, or shared drives from unknown origins, and validate provenance of third-party material packs. Because exploitation requires opening a file, restricting which users process externally-sourced assets and handling suspect files only on an isolated/sandboxed workstation meaningfully reduces exposure; the trade-off is workflow friction for teams that routinely ingest community or client-supplied assets.
More in Substance3D Designer
View allArbitrary code execution in Adobe Substance3D - Designer versions 15.1.0 and earlier arises from an out-of-bounds write
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds writ
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds writ
Path traversal in Adobe Substance3D Designer 15.1.0 and earlier enables arbitrary file system reads when a victim opens
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today