EUVD-2026-35798
GHSA-vrf3-mcj3-jvch
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) in the application's file parser. Exploitation runs in the context of the current user and no public exploit identified at time of analysis, though the high CVSS of 7.8 reflects the full local impact triad once a user is socially engineered into opening the file.
Technical ContextAI
Adobe Substance3D Sampler is a desktop application used by 3D artists to create photorealistic materials from images, scans, and procedural inputs, ingesting numerous proprietary and third-party file formats (SBSAR, SBS, image formats, mesh formats). The vulnerability class is CWE-787 (Out-of-bounds Write), a memory corruption flaw where the parser writes past the bounds of an allocated buffer - typically caused by missing length validation, integer overflow in size calculations, or incorrect bounds checks during deserialization of attacker-controlled file headers/records. The CPE cpe:2.3:a:adobe:substance3d_-_sampler:*:*:*:*:*:*:*:* indicates all builds of the Sampler product line up through 6.0.0 are in scope, and the bug almost certainly resides in a native (C/C++) file-format parser given the memory-corruption signature.
RemediationAI
Patch available per vendor advisory - upgrade Substance3D Sampler to the version specified in Adobe Security Bulletin APSB26-60 at https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-60.html (consult the bulletin for the exact fixed version, as it is not enumerated in the provided intelligence). Until the patched build is deployed, instruct artists and designers to refuse opening Substance3D project or asset files (SBSAR, SBS, scans, meshes) received from untrusted sources or unverified email attachments, and route incoming third-party assets through a sandboxed/non-privileged workstation rather than primary workstations holding source intellectual property. Application allowlisting and removing local administrator rights from creative users limits post-exploitation impact since the code runs as the current user, but does not prevent the initial compromise of that user's session.
More in Substance3D Sampler
View allArbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted a
Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs through an out-of-bounds write t
Arbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted 3
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today