CVE-2026-34664: Adobe Substance 3D Designer Path Traversal

CVE-2026-34664 Overview

CVE-2026-34664 affects Adobe Substance 3D Designer versions 15.1.0 and earlier. The flaw is a path traversal vulnerability [CWE-22] that allows arbitrary file system read outside the application's intended access scope. An attacker crafts a malicious file that, when opened by a victim, references paths escaping the expected directory boundary. Successful exploitation discloses sensitive files and directories from the host running the application. The issue carries a changed scope, meaning impact extends beyond the vulnerable component's security authority. Exploitation requires local access and user interaction, with no privileges needed on the target system.

Critical Impact
Arbitrary file system read across a changed scope, exposing sensitive files when a user opens a malicious Substance 3D Designer project.

Affected Products

Adobe Substance 3D Designer 15.1.0
Adobe Substance 3D Designer versions earlier than 15.1.0
Windows and macOS installations of Substance 3D Designer

Discovery Timeline

2026-05-12 - CVE-2026-34664 published to NVD
2026-05-12 - Adobe publishes Security Advisory APSB26-52
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34664

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory within Substance 3D Designer's file handling logic. When the application parses a project or asset file, it resolves embedded path references without validating that the resolved location stays within the intended working directory. An attacker embeds traversal sequences such as ../ or absolute paths inside a crafted file. Upon opening, the application reads from those attacker-controlled locations and exposes their contents to the application context. Because scope is changed, the disclosed data can include resources protected by a different security authority than the application itself. The vulnerability impacts confidentiality only; it does not modify files or affect availability.

Root Cause

The root cause is missing or insufficient canonicalization of file paths supplied through opened assets. The application accepts relative or absolute references without enforcing a directory allowlist, normalizing the path, or rejecting traversal characters before performing read operations.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious .sbs, .sbsar, or related project file through email, a shared repository, an asset marketplace, or a watering-hole site. The victim opens the file in Substance 3D Designer, triggering the embedded path references and disclosing file contents accessible to the user running the application. See the Adobe Security Advisory APSB26-52 for technical references.

Detection Methods for CVE-2026-34664

Indicators of Compromise

Substance 3D Designer process reading files outside of standard project, asset, and library directories.
Project or asset files containing ../ sequences, UNC paths, or absolute references to sensitive locations such as C:\Users\ or /etc/.
Substance 3D Designer opening files received from untrusted email attachments, marketplaces, or shared cloud folders.

Detection Strategies

Hunt for Designer.exe or Substance 3D Designer file-read events targeting user profile, credential, or system configuration paths.
Inspect ingested .sbs and .sbsar files for path strings referencing locations outside expected asset roots.
Correlate file-open telemetry with subsequent outbound network activity that could indicate exfiltration of disclosed content.

Monitoring Recommendations

Enable endpoint file-access auditing on workstations used for 3D content production and asset review.
Log application launches with command-line arguments and parent process to identify files delivered from messaging or browser processes.
Alert on Substance 3D Designer reads of registry hive backups, SSH keys, browser credential stores, or cloud token files.

How to Mitigate CVE-2026-34664

Immediate Actions Required

Update Adobe Substance 3D Designer to the version identified as fixed in Adobe Security Advisory APSB26-52.
Block delivery of Substance 3D Designer project files from untrusted external sources at the email and web gateway.
Instruct artists and engineers to open project files only from verified internal repositories until patching is complete.

Patch Information

Adobe addresses CVE-2026-34664 in the update tracked by Adobe Security Advisory APSB26-52. Apply the vendor-supplied patch on all Windows and macOS hosts running Substance 3D Designer 15.1.0 or earlier. Verify the installed version through the application's About dialog after deployment.

Workarounds

Restrict Substance 3D Designer execution to dedicated, low-privilege user accounts that lack access to sensitive corporate data.
Open untrusted project files only inside isolated virtual machines or sandboxed environments with no access to credential stores.
Apply application allowlisting to prevent Substance 3D Designer from being launched by mail clients or browsers handling external attachments.

bash

# Configuration example: verify installed Substance 3D Designer version on macOS
defaults read "/Applications/Adobe Substance 3D Designer/Adobe Substance 3D Designer.app/Contents/Info.plist" CFBundleShortVersionString