Substance3D Modeler
Monthly
Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local attack (CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) requires user interaction and is not known to be actively exploited; no public exploit code has been identified at time of analysis. The flaw affects the application's file parsing logic and could lead to full compromise of confidentiality, integrity, and availability for the current user.
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file in the application. The flaw is triggered during parsing of a malicious asset, so exploitation is local and requires user interaction: there is no network-reachable or drive-by path, and no public exploit code has been identified at time of analysis. With a CVSS base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no CISA KEV listing, this is a genuine but lower-priority-than-the-headline-number memory-corruption bug whose real-world impact is bounded by the privileges of the user who opens the file.
Opening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an attacker execute arbitrary code in the context of the current user. The flaw is client-side and local in nature - there is no network-facing exposure - so exploitation depends on social engineering to convince a victim to open a poisoned file, and any code that runs inherits only that user's privileges (no privilege escalation). The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) matches that assessment: high confidentiality and integrity impact, but gated behind the requirement that the user opens the file; no public exploit code or confirmed active exploitation was identified at time of analysis.
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write during file parsing, allowing an attacker to corrupt memory and execute arbitrary code under the privileges of the user running the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required (PR:N), but exploitation is gated by mandatory user interaction - the victim must open the hostile file - and the impact is confined to the current user's session rather than escalating to SYSTEM or root. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so risk is limited to environments where users routinely open untrusted 3D asset files; Adobe has published vendor guidance in advisory APSB26-155.
Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local attack (CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) requires user interaction and is not known to be actively exploited; no public exploit code has been identified at time of analysis. The flaw affects the application's file parsing logic and could lead to full compromise of confidentiality, integrity, and availability for the current user.
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file in the application. The flaw is triggered during parsing of a malicious asset, so exploitation is local and requires user interaction: there is no network-reachable or drive-by path, and no public exploit code has been identified at time of analysis. With a CVSS base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no CISA KEV listing, this is a genuine but lower-priority-than-the-headline-number memory-corruption bug whose real-world impact is bounded by the privileges of the user who opens the file.
Opening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an attacker execute arbitrary code in the context of the current user. The flaw is client-side and local in nature - there is no network-facing exposure - so exploitation depends on social engineering to convince a victim to open a poisoned file, and any code that runs inherits only that user's privileges (no privilege escalation). The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) matches that assessment: high confidentiality and integrity impact, but gated behind the requirement that the user opens the file; no public exploit code or confirmed active exploitation was identified at time of analysis.
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write during file parsing, allowing an attacker to corrupt memory and execute arbitrary code under the privileges of the user running the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required (PR:N), but exploitation is gated by mandatory user interaction - the victim must open the hostile file - and the impact is confined to the current user's session rather than escalating to SYSTEM or root. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so risk is limited to environments where users routinely open untrusted 3D asset files; Adobe has published vendor guidance in advisory APSB26-155.