Substance3D Designer
Monthly
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds write when parsing a malicious file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a crafted file, so it is a local, user-interaction-dependent flaw rather than a remotely triggerable one. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Arbitrary code execution in Adobe Substance3D - Designer 15.1.0 and earlier occurs when a victim opens a maliciously crafted asset file, triggering an out-of-bounds write in the application's file parser and running attacker code with the current user's privileges. Adobe self-reported the flaw; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 7th percentile), consistent with SSVC's assessment of no observed exploitation.
Arbitrary code execution in Adobe Substance3D - Designer versions 15.1.0 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted asset or project file, running attacker code in the context of the current user. The flaw was reported by Adobe and patched in advisory APSB26-52; there is no public exploit identified at time of analysis and EPSS is very low (0.03%, 8th percentile). SSVC records no known exploitation, but the technical impact is rated total.
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. No public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile), consistent with SSVC 'Exploitation: none.' The flaw is Adobe-reported (APSB26-52) and requires local file-open user interaction rather than remote network access.
Path traversal in Adobe Substance3D Designer 15.1.0 and earlier enables arbitrary file system reads when a victim opens a specially crafted malicious file. The vulnerability carries a scope change - the attacker can read files and directories outside the application's own data boundaries, potentially exposing OS-level sensitive content. No public exploit has been identified at time of analysis, EPSS sits at 0.02% (5th percentile), and CISA SSVC rates exploitation as none with non-automatable delivery, indicating limited real-world threat momentum despite the High confidentiality impact rating.
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds write when parsing a malicious file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a crafted file, so it is a local, user-interaction-dependent flaw rather than a remotely triggerable one. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Arbitrary code execution in Adobe Substance3D - Designer 15.1.0 and earlier occurs when a victim opens a maliciously crafted asset file, triggering an out-of-bounds write in the application's file parser and running attacker code with the current user's privileges. Adobe self-reported the flaw; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 7th percentile), consistent with SSVC's assessment of no observed exploitation.
Arbitrary code execution in Adobe Substance3D - Designer versions 15.1.0 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted asset or project file, running attacker code in the context of the current user. The flaw was reported by Adobe and patched in advisory APSB26-52; there is no public exploit identified at time of analysis and EPSS is very low (0.03%, 8th percentile). SSVC records no known exploitation, but the technical impact is rated total.
Arbitrary code execution in Adobe Substance3D - Designer (versions 15.1.0 and earlier) arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. No public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile), consistent with SSVC 'Exploitation: none.' The flaw is Adobe-reported (APSB26-52) and requires local file-open user interaction rather than remote network access.
Path traversal in Adobe Substance3D Designer 15.1.0 and earlier enables arbitrary file system reads when a victim opens a specially crafted malicious file. The vulnerability carries a scope change - the attacker can read files and directories outside the application's own data boundaries, potentially exposing OS-level sensitive content. No public exploit has been identified at time of analysis, EPSS sits at 0.02% (5th percentile), and CISA SSVC rates exploitation as none with non-automatable delivery, indicating limited real-world threat momentum despite the High confidentiality impact rating.