EUVD-2026-65643
GHSA-6746-v85x-hv7w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Substance 3D Sampler file
-
DeliveryDeliver via phishing or compromised asset-sharing platform
-
ExploitVictim opens file in Substance 3D Sampler
-
ExecutionOut-of-bounds write corrupts adjacent memory
-
ImpactArbitrary code executes as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open a specially crafted file in Adobe Substance 3D Sampler - no network-accessible service or listening port is involved. The CVSS vector AV:L/PR:N/UI:R confirms a local, no-privilege-required, user-interaction-dependent attack: the attacker requires no account on the target system, but the victim must open the malicious file. Exploitation is bounded by scope unchanged (S:U), meaning the attack cannot directly escalate beyond the current user's privilege level to system or kernel access. No non-default configuration, specific enabled feature, or particular platform is cited as a prerequisite - any standard Substance 3D Sampler installation capable of opening project files is exposed once the victim opens the crafted file. |
| Impact | CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a file-parsing RCE with low attack complexity once the victim opens the malicious file. The absence of a KEV listing and no identified public POC suggests exploitation is not currently widespread; however, the phishing-friendly delivery model - requiring only that a user open a crafted file - means studios, agencies, and game developers who routinely exchange Substance 3D project files with external partners face meaningful real-world exposure. No EPSS data was supplied, so probability-of-exploitation cannot be quantified numerically. The scope-unchanged flag (S:U) limits blast radius to the current user account, reducing enterprise-wide lateral movement risk compared to a privilege-escalating variant, but does not eliminate risk of credential theft or local data exfiltration within that session. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Sampler project file embedding a payload that triggers the out-of-bounds write during the application's file-parsing routine. The file is delivered to a target - such as a 3D artist or materials designer - via email attachment, a file-sharing service, or a compromised asset marketplace. When the victim opens the file in Substance 3D Sampler, memory corruption silently executes arbitrary code under the user's account, enabling installation of a backdoor, credential harvesting, or exfiltration of local project assets. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted file. All versions covered by CPE cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:* are listed as affected, with Adobe addressing the issue via advisory APSB26-121. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, though the file-open delivery mechanism fits common phishing and supply-chain vectors targeting creative professionals.
RemediationAI
The primary remediation is to apply the patch released by Adobe under advisory APSB26-121, available at https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-121.html; the exact fixed version must be confirmed directly from that bulletin, as the NVD CPE entry uses a wildcard range without specifying a patched release. As a compensating control prior to patching, organizations should restrict Substance 3D Sampler users from opening project files received from untrusted or unverified external sources, and consider enforcing file-origin policies via OS-level sandboxing mechanisms such as macOS Gatekeeper quarantine or Windows Defender Application Guard where supported. These controls add friction to exploitation but do not eliminate risk if users override security warnings or receive files through trusted-but-compromised channels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Substance 3D Sampler is a physically-based 3D material capture and authoring tool that ingests complex proprietary file formats encoding texture maps, scene graphs, and material definitions. The root cause is CWE-787 (Out-of-Bounds Write): during parsing of a maliciously crafted file, the application writes beyond the bounds of an allocated buffer, corrupting adjacent memory in ways that can redirect execution flow to attacker-controlled code. The CVSS vector AV:L reflects that exploitation is triggered locally via a file-open action rather than through a network-accessible service. The CPE string uses a wildcard version range, indicating that NVD has not published a precise version ceiling; the authoritative affected-version list resides in Adobe Security Bulletin APSB26-121.
Know when Adobe Substance 3D Sampler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open exploit requires no attacker privileges; local vector with mandatory user interaction; full C/I/A impact confirmed, scope unchanged to user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Sampler contains a critical remote code execution vulnerability (CVE-2026-48418, CVSS 7.8) triggered when users open specially crafted project files, enabling arbitrary code execution at user privilege level. This poses significant risk to creative and design teams through phishing and supply-chain attack vectors, with no vendor patch currently available to remediate the exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce file-origin validation policies requiring users to verify file sources before opening in Sampler; implement application whitelisting on systems with Sampler to prevent unauthorized code execution; enable comprehensive logging and monitoring of file access and process execution from Sampler; restrict network access from affected systems to limit lateral movement if exploitation occurs; conduct user awareness training emphasizing phishing risks and external file handling procedures; and consider air-gapping or network segmentation of workstations running Sampler until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Substance 3D Sampler
View allHeap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-i
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the victim u
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the authenti
Stack-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution under the privileges of the cu
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's secu
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the current use
Out-of-bounds write (CWE-787) in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the a
Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution in the current user's context when a
Out-of-bounds write in Adobe Substance 3D Sampler (all versions per CPE) enables arbitrary code execution under the vict
Exploit-DB