CVE-2026-34681 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D - Designer versions 15.1.0 and earlier. This vulnerability allows an attacker to execute arbitrary code in the context of the current user if the victim opens a crafted malicious file. The CVSS v3.1 base score is 7.8, indicating high severity with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and the product is not a cloud service.

Successful exploitation can result in arbitrary code execution with full impact on confidentiality, integrity, and availability of the affected system under the current user context. This could allow attackers to execute malicious code, potentially leading to system compromise or data loss. Exploitation requires user interaction, specifically opening a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources and consider restricting access to Substance3D - Designer or running it with least privilege to limit potential impact.