CVE-2026-48305: Substance3D - Sampler | Out-of-bounds Write (CWE-787)

Synopsis

An out-of-bounds write vulnerability affects Adobe Substance3D - Sampler versions 6.0.0 and earlier. The flaw is triggered locally when a user opens a specially crafted file, requiring no prior authentication but demanding that a victim perform that file-open action. Successful exploitation gives the attacker full code execution running as the current user, enabling data theft, file modification, and further system compromise. No fix version has been published yet; HarborGuard tracks the advisory and will flag patched rebuilds the moment upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger this vulnerability.

• AuthenticationNot required

  No account or credentials are required; the exploit is reachable by any unauthenticated party who can deliver a malicious file to the victim.

• Victim interactionRequired

  The victim must open a malicious file, making this a social-engineering dependent attack where the attacker must convince a user to open the crafted document.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental prerequisites beyond the victim opening the file.

Blast Radius

• Executes arbitrary code in the context of the logged-in user, giving the attacker full control over that user session.
• Reads files and secrets accessible to the current user, including credentials, project assets, and stored configuration.
• Writes or overwrites files on the local filesystem within the current user's permissions, enabling persistent implants or data destruction.
• Crashes or destabilizes the Substance3D - Sampler process, disrupting the local user's workflow and potentially corrupting open project files.