EUVD-2026-84795
GHSA-7f4f-c98f-47rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious 3D model file
-
DeliveryDeliver file to victim via email/shared asset
-
ExploitVictim opens file in Substance3D Modeler
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim with Adobe Substance3D Modeler installed to open an attacker-crafted malicious file (a 3D model/project asset) in the application; the OOB write is triggered during file parsing. Limiting factors: this is a local, client-side attack (AV:L) with mandatory user interaction (UI:R) - there is no remote or network-triggerable path and no unauthenticated server exposure. Code execution is confined to the privileges of the current user (S:U), not SYSTEM/root. Risk is therefore bounded to environments where users open untrusted 3D asset files. |
| Impact | This is a genuine but context-limited risk. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) makes clear this is NOT a remotely-reachable server flaw: AV:L combined with UI:R means exploitation requires a local victim to open a malicious file in Substance3D Modeler - there is no network-facing attack surface. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation; the sole source is Adobe's own advisory APSB26-155. The 7.8 rating is driven entirely by the full C:H/I:H/A:H impact triad (arbitrary code execution) rather than by ease or likelihood of exploitation. In practical prioritization terms this is a client-side, user-interaction-gated memory-corruption bug in a niche creative-tools application - real but low urgency absent evidence of exploitation, and best treated as a routine patch-management item rather than an emergency. No conflicting signals were found in the data; the CVSS vector and the description are consistent (both point to local file-open exploitation). |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D model/project file and delivers it to a target (e.g., via email, a shared asset library, or a compromised download), relying on social engineering to get the victim to open it in Substance3D Modeler. When the application parses the file, an out-of-bounds write (CWE-787) corrupts memory and results in arbitrary code execution in the context of the current user. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write during file parsing, allowing an attacker to corrupt memory and execute arbitrary code under the privileges of the user running the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required (PR:N), but exploitation is gated by mandatory user interaction - the victim must open the hostile file - and the impact is confined to the current user's session rather than escalating to SYSTEM or root. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so risk is limited to environments where users routinely open untrusted 3D asset files; Adobe has published vendor guidance in advisory APSB26-155.
RemediationAI
Patch available per vendor advisory: upgrade Adobe Substance 3D Modeler to the fixed build identified in Adobe security bulletin APSB26-155 (https://helpx.adobe.com/security/products/substance3d-modeler/apsb26-155.html), which is the authoritative source for the exact patched version number; Creative Cloud desktop users should apply the update through the Creative Cloud application, and managed environments should push it via their software-deployment tooling. Until the update is applied, the most effective compensating control is to treat 3D asset and project files as untrusted input: block or quarantine inbound model files from external sources at the email and web gateway, and instruct users not to open assets of unknown provenance - traded off against reduced workflow flexibility for teams that legitimately exchange 3D content. Additionally, run Substance 3D Modeler under a low-privilege, non-administrative account and, where practical, inside an isolated VM or sandbox dedicated to inspecting untrusted content, which limits the blast radius of successful code execution to that constrained environment at the cost of convenience and hardware overhead. Application allowlisting and disabling automatic file-association handling for 3D asset types can further reduce the chance of accidental opening, noting that these controls do not remediate the underlying memory-safety defect and remain temporary until the vendor patch is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (Out-of-bounds Write), a memory-safety defect in the file-parsing path of Adobe Substance 3D Modeler, the desktop modeling component of Adobe's Substance 3D suite used to author and import 3D model/project assets. When the application parses a crafted asset file, it writes data beyond the bounds of an allocated buffer, corrupting adjacent heap or stack memory. Because the corrupted memory can influence control-flow data, successful exploitation yields arbitrary code execution in the security context of the current user (S:U), i.e., code that runs with the same rights as the victim's interactive session rather than system-level privileges. The attack vector is local (AV:L) in the sense that the malformed file must be opened inside the application on the victim's machine; there is no network-facing service component and no server-side exposure. Per the supplied CPE (cpe:2.3:a:adobe:substance3d_-_modeler:*:*:*:*:*:*:*:*), the affected product identifier covers Adobe Substance 3D Modeler generally, and the referenced vendor advisory at helpx.adobe.com/security/products/substance3d-modeler/apsb26-155.html is the authoritative source for the exact vulnerable version range and the corresponding fix build.
Know when Substance3D Modeler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parse bug requiring a victim to open a crafted file (AV:L/UI:R), no pre-auth needed by the attacker (PR:N), yielding full current-user code execution (C:H/I:H/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Modeler contains a high-severity memory-corruption flaw (CVE-2026-79906) that a crafted 3D asset file can trigger when a user simply opens it, potentially handing an attacker code execution with that user's own account rights. The exposure is concentrated in creative and design teams that routinely import models and project assets from external or untrusted sources, where a single opened file could compromise the workstation and any sensitive project data or connected services it can reach. Because no vendor fix is currently available, leadership should treat this as a manageable but open risk requiring interim controls rather than an immediate emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: block or quarantine untrusted 3D model and project asset files and scan them in a sandbox before opening; restrict file ingestion to trusted sources and approved asset repositories; run Modeler with least-privilege accounts and application control/allowlisting to limit post-exploitation reach; enable endpoint detection and response monitoring for memory-corruption and process-injection indicators; isolate asset review in a virtual desktop or sandbox; monitor Adobe advisory APSB26-155 for a patch and apply it as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Substance3D Modeler
View allOpening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an
Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the curren
Exploit-DB