EUVD-2026-29745
GHSA-j5qh-vw5f-gp23
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open attack (AV:L, UI:R) needing no app privileges (PR:N); memory-corruption RCE yields full C/I/A impact within the user's context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
5DescriptionCVE.org
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. No public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile), consistent with SSVC 'Exploitation: none.' The flaw is Adobe-reported (APSB26-52) and requires local file-open user interaction rather than remote network access.
Technical ContextAI
Substance3D - Designer is Adobe's node-based material-authoring application used to create textures and 3D materials, ingesting numerous binary/image and project file formats through native parsing code. The root cause is CWE-787 (Out-of-bounds Write): during parsing of a malformed file, the application writes past the bounds of an allocated buffer, corrupting adjacent memory. The affected product is identified by CPE cpe:2.3:a:adobe:substance3d_-_designer:*:*:*:*:*:*:*:*, and vendor tags (Memory Corruption, Buffer Overflow, RCE) reinforce that a heap/stack buffer overflow in the file parser is the exploitation primitive that can be steered into control-flow hijack.
RemediationAI
Upgrade Substance3D - Designer to the fixed release published in Adobe security bulletin APSB26-52 (https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html); the advisory specifies the exact patched version - no fixed version number was provided in this dataset, so consult APSB26-52 directly and treat it as 'Patch available per vendor advisory.' Until patched, the practical compensating control is to not open Substance3D project or material files received from untrusted or unverified sources and to restrict file exchange to trusted internal repositories, since exploitation strictly requires a victim to open a malicious file (trade-off: this constrains collaboration workflows that rely on sharing external assets). Application allow-listing and running the app as a non-privileged user further limit the blast radius, as code executes only in the current user's context.
More in Substance3D Designer
View allArbitrary code execution in Adobe Substance3D - Designer versions 15.1.0 and earlier arises from an out-of-bounds write
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds writ
Arbitrary code execution in Adobe Substance3D - Designer 15.1.0 and earlier occurs when a victim opens a maliciously cra
Path traversal in Adobe Substance3D Designer 15.1.0 and earlier enables arbitrary file system reads when a victim opens
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today