EUVD-2026-65638
GHSA-262r-gh7x-jh44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Substance 3D asset file
-
DeliveryDeliver file via phishing or asset repository
-
ExploitVictim opens file in Substance 3D Sampler
-
ExecutionHeap buffer overflow triggered during file parsing
-
ImpactArbitrary code executed as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim actively open a malicious file within Adobe Substance 3D Sampler - there is no network-listening component or remote attack surface. The attacker must first deliver the crafted file to the victim through social engineering, phishing, a compromised asset-sharing pipeline, or a malicious download. Exploitation is limited to the privileges of the currently logged-in user (S:U, no privilege escalation beyond the user context). No authentication or special system configuration is required beyond the victim's normal use of the application. The key limiting factor is mandatory user interaction (UI:R): the victim must be persuaded to open the file, which cannot be automated without that action. |
| Impact | The CVSS 7.8 score with AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately characterizes this as a high-severity local file-parsing flaw requiring no privileges but mandatory user interaction. The local attack vector (AV:L) is consistent with the described exploitation mechanism - a victim must open a malicious file - which limits mass automated exploitation but makes the vulnerability well-suited for targeted spear-phishing or supply chain file delivery against creative professionals. No EPSS data was provided in the source intelligence, and the CVE has not appeared in the CISA KEV catalog as of this analysis, meaning active exploitation is not confirmed. No public proof-of-concept exploit has been identified. The combination of high C/I/A impact with the social engineering prerequisite places this in a realistic but not imminent threat category; studios and production pipelines handling externally sourced 3D assets face the most credible exposure. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D material or texture file designed to trigger the heap overflow during Substance 3D Sampler's file parsing routine. The file is delivered to a target - a game artist or 3D designer - via email, a shared asset repository, or a compromised asset marketplace. When the victim opens the file, the overflow corrupts heap memory in a manner that redirects execution to attacker-controlled shellcode, granting the attacker code execution under the victim's user account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution under the privileges of the current user when a victim opens a crafted malicious file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow), a memory corruption class that reliably yields code execution primitives in native applications. No public exploit code or active exploitation has been identified at time of analysis; however, the high CVSS score (7.8) and confirmed arbitrary code execution impact make this a meaningful risk for users in creative and 3D content production pipelines.
RemediationAI
The primary remediation is to apply the update described in Adobe Security Bulletin APSB26-121 (https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-121.html); the advisory provides the specific fixed version. Until the patch is applied, the most effective compensating control is to restrict opening of 3D asset or image files received from untrusted or external sources within Substance 3D Sampler. Organizations should advise users not to open files sent via email, messaging platforms, or file-sharing services without verifying the sender's identity through an out-of-band channel. Sandboxing or running the application in an isolated virtual environment would limit the blast radius of exploitation to the sandbox scope, but adds operational friction for creative workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Substance 3D Sampler (CPE: cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:*) is a material and texture creation application in Adobe's Substance 3D suite, widely used in game development, product visualization, and architectural rendering. CWE-122 (Heap-based Buffer Overflow) indicates the application writes beyond the bounds of a heap-allocated buffer during file parsing, likely when processing a supported 3D asset or image format. This class of flaw allows an attacker to corrupt adjacent heap metadata or function pointers, leading to controlled code execution. The local attack vector (AV:L) reflects that exploitation is triggered by the act of opening a file within the application rather than via a network-exposed service.
Know when Adobe Substance 3D Sampler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-triggered local exploitation requires no privileges (PR:N) but mandatory user interaction (UI:R); full C/I/A reflects arbitrary code execution with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Sampler contains a heap-based buffer overflow vulnerability (CVE-2026-48424, CVSS 7.8) that enables arbitrary code execution when users open malicious files, creating direct risk to creative and design teams whose workflows depend on 3D asset handling. Without vendor-supplied patches, organizations must implement immediate compensating controls to prevent exploitation through supply-chain-adjacent attack vectors where compromised 3D models could be distributed across production environments. This vulnerability poses a material business continuity and data security risk for any organization using Substance 3D Sampler in active production.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) run Substance 3D Sampler in air-gapped or sandboxed environments isolated from sensitive data; (2) restrict file access to known-good, internally-verified 3D model sources only; (3) deploy endpoint detection and response (EDR) tooling to detect suspicious process execution or file access patterns on affected systems; (4) educate users on file-source verification and prohibit opening externally-sourced 3D model files until patched; (5) establish weekly vendor advisory monitoring to enable rapid deployment of patches once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Substance 3D Sampler
View allHeap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-i
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the victim u
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the authenti
Stack-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's secu
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the current use
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution at the privilege level of the logged-
Out-of-bounds write (CWE-787) in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the a
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution in the current user's context when a
Out-of-bounds write in Adobe Substance 3D Sampler (all versions per CPE) enables arbitrary code execution under the vict
Exploit-DB