CVE-2026-34664 is a path traversal vulnerability in Adobe Substance3D - Designer (versions 15.1.0 and earlier) that improperly limits pathname access to restricted directories. This flaw allows an attacker who can convince a user to open a crafted malicious file to read arbitrary files on the victim's file system outside the intended scope. The vulnerability changes the security scope and impacts confidentiality without affecting integrity or availability. The CVSS 3.1 base score is 6.3, reflecting local attack vector, low complexity, no privileges required, user interaction needed, and high confidentiality impact. No patch or official remediation level has been published by Adobe as of the data provided.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the victim's system, compromising confidentiality. There is no impact on data integrity or system availability. The attack requires user interaction, limiting the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources to avoid triggering the vulnerability.