CVE-2026-34674: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-34674 is a Heap-based Buffer Overflow vulnerability in Adobe Substance 3D Sampler versions 5.1.3 and earlier that can result in arbitrary code execution in the context of the current user. The vulnerability was disclosed by Adobe on May 12, 2026, and published to the NVD on August 27, 2026. It carries a CVSS v3.1 base score of 7.8 (High), requiring local access and user interaction but no special privileges (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), occurring when the application processes a specially crafted malicious file, causing a write operation to overflow a heap-allocated buffer. The attack vector is local, requiring no privileges, but does require a victim to open a malicious file — a social engineering precondition. The associated CAPEC pattern is CAPEC-92 (Forced Integer Overflow), suggesting the overflow may be triggered via malformed size or length values in a parsed file format (GitHub Advisory, Adobe Advisory).

Successful exploitation results in arbitrary code execution with the privileges of the current user, yielding high impact to confidentiality, integrity, and availability. An attacker who tricks a victim into opening a malicious file could fully compromise the affected workstation, access sensitive data, install malware, or pivot to other systems on the network. The scope is unchanged, meaning the impact is contained to the security context of the vulnerable application, but full user-level compromise is achievable (Adobe Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the latest update (Adobe Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment confirms exploitation status as "none" and the vulnerability as non-automatable. The EPSS score is approximately 0.238%, placing it in the 15th percentile for exploitation likelihood within 30 days (GitHub Advisory).

1. Craft a malicious file: Create a specially crafted file (e.g., a texture or material file supported by Substance 3D Sampler) that contains malformed data designed to trigger a heap buffer overflow during parsing.
2. Deliver the file: Distribute the malicious file to a target user via phishing email, file-sharing platform, or compromised website, using social engineering to convince the victim to open it.
3. Victim opens the file: The victim opens the malicious file in Adobe Substance 3D Sampler version 5.1.3 or earlier, triggering the vulnerable file parsing routine.
4. Trigger heap overflow: The malformed size or length values in the file cause the application to write beyond the bounds of a heap-allocated buffer (CWE-122), corrupting adjacent heap memory.
5. Achieve code execution: By controlling the overflow data, the attacker overwrites heap metadata or function pointers to redirect execution flow, achieving arbitrary code execution in the context of the current user (Adobe Advisory, GitHub Advisory).

• Process: Unexpected child processes spawned by the Adobe Substance 3D Sampler process (e.g., cmd.exe, powershell.exe, bash, curl, or network-connecting processes).
• File System: Unexpected files written to user-accessible directories (temp folders, AppData, or startup locations) shortly after opening a Substance 3D Sampler file; presence of unknown or suspicious .sbs, .sbsar, or other Sampler-format files from untrusted sources.
• Network: Outbound network connections initiated by the Substance 3D Sampler process to unknown external IP addresses or domains, particularly following file open events.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing the Substance 3D Sampler executable around the time of file open; heap corruption or access violation errors in application logs.

Adobe has released version 6.0 of Substance 3D Sampler as the patched release; users should update immediately from version 5.1.3 or earlier to 6.0 or later (Adobe Advisory). As interim mitigations, organizations should restrict access to untrusted files, educate users about the risks of opening files from unknown sources, and consider disabling or removing the application if patching cannot be applied promptly. Detection coverage is available via Qualys (detection ID 387310) and Nessus (plugin ID 314924).

The CIS (Center for Internet Security) issued an advisory noting multiple Adobe vulnerabilities in May 2026 that could allow arbitrary code execution, including this issue (CIS Advisory). CISA referenced the vulnerability in its weekly bulletin (SB26-243). No significant independent researcher commentary or social media discussion has been identified for this specific CVE.