EUVD-2026-35800
GHSA-gxgj-33xm-g642
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted asset file that triggers an out-of-bounds write in the application's parsing logic. Exploitation runs in the context of the logged-in user and requires user interaction to open the file; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Substance3D Sampler is Adobe's material-authoring tool used by 3D artists and game/VFX pipelines to capture physically-based materials from photographs and scans. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application writes past the end of an allocated buffer - typically during parsing of an attacker-controlled file format (textures, scenes, or material packages). The affected CPE is cpe:2.3:a:adobe:substance3d_-_sampler:*, covering all builds up to and including 6.0.0 across supported desktop platforms. Successful out-of-bounds writes in native desktop code commonly enable control-flow hijack or write-what-where primitives leading to arbitrary code execution as the invoking user.
RemediationAI
Patch available per vendor advisory APSB26-60 - upgrade Substance3D Sampler to the fixed version listed at https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-60.html using the Creative Cloud desktop app or enterprise admin console; the exact fixed version number was not provided in the input data, so verify against the advisory before rollout. Until the patch is applied, restrict Sampler users to opening only files from trusted internal repositories, block ingestion of Sampler project and material files (.sbs, .sbsar, scan packages) from email and untrusted marketplaces at the mail/web gateway, and consider running Sampler under a standard (non-admin) account to limit blast radius if exploited (trade-off: artists may lose access to some plugins or driver-level features). Application allowlisting and EDR rules that flag Sampler spawning shells or scripting interpreters provide useful detection compensating controls but do not prevent the underlying memory corruption.
More in Substance3D Sampler
View allArbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs through an out-of-bounds write t
Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs when a victim opens a maliciousl
Arbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted 3
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today