CVE-2026-34710: Substance3D - Sampler | Out-of-bounds Write (CWE-787)

Synopsis

Out-of-bounds write vulnerability in Adobe Substance3D - Sampler (versions 6.0.0 and earlier). The vulnerability is triggered locally and requires no authentication, but does require a victim to open a specially crafted malicious file. Successful exploitation gives an attacker arbitrary code execution running as the current user. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access is required to trigger this vulnerability.

• AuthenticationNot required

  No account or credentials are needed to exploit this vulnerability; the attack is carried out through a malicious file without any authentication step.

• Victim interactionRequired

  A victim must be socially engineered into opening a malicious file for the exploit to trigger.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the crafted file; no race conditions or specific memory layout dependencies are required.

Blast Radius

• The attacker executes arbitrary code in the context of the current user, gaining full control of any process Substance3D - Sampler is running as.
• All files, credentials, and session tokens accessible to that user account are readable by the attacker.
• The attacker can write or modify any files the current user has permission to change, including configuration files and stored project assets.
• The affected application and any dependent services can be crashed or made unresponsive at the attacker's discretion.