CVE-2026-21337: Adobe Substance 3D Designer Info Leak

CVE-2026-21337 Overview

CVE-2026-21337 is an out-of-bounds read vulnerability [CWE-125] in Adobe Substance 3D Designer versions 15.1.0 and earlier. The flaw allows an attacker to read memory outside the bounds of an allocated buffer when the application processes a crafted file. Successful exploitation can expose sensitive information stored in process memory.

The vulnerability requires local access and user interaction. A victim must open a malicious file in Substance 3D Designer for exploitation to occur. Adobe published security advisory APSB26-19 to address the issue.

Critical Impact

Attackers can read out-of-bounds memory to extract sensitive information from the Substance 3D Designer process when a user opens a malicious project file.

Affected Products

• Adobe Substance 3D Designer 15.1.0
• Adobe Substance 3D Designer earlier than 15.1.0
• Windows and macOS installations of Substance 3D Designer

Discovery Timeline

• 2026-02-10 - CVE-2026-21337 published to the National Vulnerability Database (NVD)
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-21337

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125]. Substance 3D Designer reads data past the end, or before the beginning, of an intended buffer while parsing a crafted file. The read operation returns memory contents that the application was not authorized to access.

Attackers can leverage the leaked memory to disclose process state. Examples include heap layout details, pointers useful for bypassing address space layout randomization (ASLR), or fragments of other documents loaded in the same process. The flaw does not directly grant code execution, but it provides primitives that aid follow-on attacks.

Exploitation requires user interaction. The victim must open the malicious file using Substance 3D Designer. The attack vector is local because the application processes the file on the user's machine, but delivery can occur through email, shared project repositories, or asset marketplaces.

Root Cause

The root cause is missing or incorrect bounds checking inside a file parser used by Substance 3D Designer. When the parser interprets attacker-controlled length or offset fields, it dereferences memory addresses outside the allocated buffer. Adobe has not published a detailed root-cause writeup beyond the advisory APSB26-19.

Attack Vector

An attacker crafts a malicious Substance 3D project or asset file with manipulated structural fields. The attacker delivers the file to a victim through phishing, asset sharing platforms, or compromised supply chains. The victim opens the file in Substance 3D Designer, triggering the out-of-bounds read and leaking memory contents that the attacker can recover from the rendered output, error data, or a paired exploit chain.

No verified proof-of-concept code is available for CVE-2026-21337.
Refer to Adobe Security Advisory APSB26-19 for technical details.

Detection Methods for CVE-2026-21337

Indicators of Compromise

• Substance 3D Designer process crashes or abnormal terminations shortly after opening a new project file
• Unexpected Substance 3D Designer files (.sbs, .sbsar) arriving from untrusted email senders or external file shares
• Endpoint logs showing Substance 3D Designer spawning unusual child processes immediately after a file open event

Detection Strategies

• Inventory endpoints running Substance 3D Designer and flag any installation at or below version 15.1.0
• Monitor for execution of Substance 3D Designer with command-line arguments referencing files from temporary, download, or email staging directories
• Inspect crash telemetry and Windows Error Reporting (WER) data for access violations originating in Substance 3D Designer modules

Monitoring Recommendations

• Enable file-open auditing on workstations used by 3D artists and forward events to a centralized data lake for correlation
• Track delivery of .sbs, .sbsar, and related Substance file formats through email and collaboration platforms
• Alert on Substance 3D Designer process memory dumps written to disk, which can indicate exploitation attempts targeting leaked memory

How to Mitigate CVE-2026-21337

Immediate Actions Required

• Update Adobe Substance 3D Designer to the fixed version listed in Adobe Security Advisory APSB26-19
• Restrict opening of Substance 3D project files received from untrusted sources until the patch is applied
• Inform 3D content creators of the risk and require validation of file origin before opening external assets

Patch Information

Adobe addresses CVE-2026-21337 in the update referenced by advisory APSB26-19. Administrators should deploy the update through the Adobe Creative Cloud desktop application or enterprise software distribution tools. Review the Adobe Security Advisory APSB26-19 for exact fixed-version numbers and download locations.

Workarounds

• Block inbound .sbs and .sbsar attachments at the email gateway until patching is complete
• Open untrusted Substance 3D files only on isolated, non-production workstations without access to sensitive data
• Apply application allowlisting to prevent unauthorized Substance 3D Designer installations on systems that do not require the software

# Verify installed Substance 3D Designer version on Windows
# PowerShell example - check installed application version
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like "*Substance 3D Designer*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation