Substance 3D Designer EUVD-2026-65631

Exploitation requires the victim to actively open a malicious file using Adobe Substance 3D Designer - this is the sole prerequisite stated in the CVE description and reflected in the CVSS UI:R metric. No authentication, network service exposure, or non-default configuration is needed; the attack surface is entirely the application's file-parsing code. The local attack vector (AV:L) and user-interaction requirement (UI:R) together limit exploitation to scenarios where the attacker can deliver a crafted file to the victim and induce them to open it. Exploitation is bounded by user privilege level (S:U, unchanged scope), meaning code executes only in the context of the user running Designer - lateral movement would require a separate privilege escalation step. No specific platform, operating system version, or optional feature enablement is described as required.

The CVSS 7.8 High score is calibrated accurately for this class of vulnerability: the local attack vector (AV:L) and required user interaction (UI:R) temper the raw impact, but arbitrary code execution with high confidentiality, integrity, and availability impact (C:H/I:H/A:H) represents meaningful post-exploitation capability. No EPSS score was supplied, and the absence of both a CISA KEV entry and a public POC means exploitation probability cannot be quantified from external signals. The local vector does not imply the attack is hard to trigger in practice - Substance 3D Designer users routinely exchange material libraries, project archives, and asset files, giving adversaries a natural delivery channel through email, shared drives, or community marketplaces. Even a small creative studio with no dedicated security team should treat this as urgent given how naturally the file-based trigger fits into normal workflows. The unchanged scope (S:U) limits blast radius to the current user session, which is a modest constraint in environments where designers operate with standard user privileges, but more consequential where local admin rights are common.

An attacker crafts a malicious Substance 3D Designer project file embedding a heap-overflowing payload within a parsed data structure, then delivers it to a target designer via email, a shared asset repository, or a community file exchange. When the victim opens the file in Designer, the parser triggers the overflow, overwriting heap memory in a way that redirects execution to attacker-controlled shellcode, resulting in code execution under the victim's user account. No public POC has been identified at time of analysis, but the file-format delivery mechanism requires no network exposure from the victim.