EUVD-2026-29744
GHSA-rchg-6562-67qr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing bug needing the victim to open a malicious file, so AV:L and UI:R; no attacker auth (PR:N) and code execution yields full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds write when parsing a malicious file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a crafted file, so it is a local, user-interaction-dependent flaw rather than a remotely triggerable one. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Technical ContextAI
Substance3D - Designer is Adobe's node-based material-authoring application used to create textures and PBR materials for 3D, games, and VFX pipelines. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application writes past the bounds of an allocated buffer - here almost certainly during parsing of a maliciously crafted project or asset file format. The CPE cpe:2.3:a:adobe:substance3d_-_designer:*:*:*:*:*:*:*:* confirms the affected component is the Designer desktop application itself. Out-of-bounds writes of this kind can corrupt adjacent heap/stack structures and, when the attacker controls the overwritten data, be leveraged to hijack control flow and achieve arbitrary code execution, which matches the vendor's 'total' technical-impact rating.
RemediationAI
Upgrade Substance3D - Designer to the fixed release identified in Adobe security bulletin APSB26-52 (https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html); Adobe confirms a patch is available per the advisory, though the exact fixed version number is not included in the provided data and should be taken directly from APSB26-52. As this is a file-parsing bug requiring user interaction, effective compensating controls until patching include: treat Substance/SBS/SBSAR and other project files from untrusted or external sources as suspicious and open them only from known-good origins; restrict receipt of such files via email/download gateways where feasible; and run Designer under least-privilege user accounts so that code execution 'in the context of the current user' does not yield elevated privileges. The trade-off of blocking external asset files is disruption to collaborative art pipelines that legitimately exchange Substance files.
More in Substance3D Designer
View allArbitrary code execution in Adobe Substance3D - Designer versions 15.1.0 and earlier arises from an out-of-bounds write
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds writ
Arbitrary code execution in Adobe Substance3D - Designer 15.1.0 and earlier occurs when a victim opens a maliciously cra
Path traversal in Adobe Substance3D Designer 15.1.0 and earlier enables arbitrary file system reads when a victim opens
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today