CVE-2026-48305: Substance3D - Sampler | Out-of-bounds Write (CWE-787)
Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Substance3D - Samplerfrom your environment.If practical, uninstall or disable Substance3D - Sampler (versions 6.0.0 and earlier) or prevent its use on high-risk systems until an official vendor patch is available.
- Compensating control
Prevent or strongly restrict opening untrusted files that could target Substance3D - Sampler. Implement email/edge filtering and quarantine for suspicious attachments, block or sandbox Sampler-related file types at the perimeter, and require files to be opened only in isolated environments (VMs or application sandboxes) until a vendor fix is available.
- Operational
Inform and instruct users that exploitation requires opening a malicious file; require users not to open unexpected or untrusted files and to report suspicious files to the security team. Monitor the vendor for an official patch or advisory and plan to apply the vendor-supplied update when released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48305?
The severity of CVE-2026-48305 is rated high, with a CVSS score of 7.8.
What software is affected by CVE-2026-48305?
CVE-2026-48305 affects Adobe Substance 3D Sampler versions 6.0.0 and earlier.
How do I fix CVE-2026-48305?
To mitigate CVE-2026-48305, users should upgrade Adobe Substance 3D Sampler to the latest version.
What type of vulnerability is CVE-2026-48305 classified as?
CVE-2026-48305 is classified as an out-of-bounds write vulnerability (CWE-787).
What is the potential impact of exploiting CVE-2026-48305?
Exploiting CVE-2026-48305 could lead to arbitrary code execution in the context of the current user.