CVE-2026-34709: Substance3D - Sampler | Out-of-bounds Write (CWE-787)

Synopsis

Out-of-bounds write vulnerability in Adobe Substance3D - Sampler (versions 6.0.0 and earlier) allows an attacker to corrupt memory by convincing a victim to open a specially crafted file. The attack is local-vector, requires no authentication, but does require the target user to open a malicious file. Successful exploitation gives the attacker arbitrary code execution running as the current user. No fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attack vector is local (AV:L), so the attacker needs an existing shell or process on the host rather than any network path to the service.

• AuthenticationNot required

  No credentials or account privileges are needed (PR:N); the attacker only needs to deliver a malicious file to the target.

• Victim interactionRequired

  The victim must open a malicious file (UI:R), making a social-engineering or phishing step necessary to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker executes arbitrary code in the context of the current user, gaining full control over that process.
• The attacker reads any files and secrets accessible to the current user account, including application credentials and local data stores.
• The attacker modifies or deletes files and configuration data within the user's permissions scope.
• The affected application process can be crashed or held hostage, disrupting any dependent workflows running under that user context.