CVE-2026-83965: Stack-based Buffer Overflow (CWE-121) in Adobe Substance 3D Sampler

CVE-2026-83965 is a stack-based buffer overflow vulnerability in Adobe Substance 3D Sampler that allows an attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions >=0 and <=6.0.3. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in arbitrary code execution with the privileges of the current user, potentially leading to full compromise of the affected system's user context. The requirement for user interaction limits remote exploitation but does not eliminate risk from targeted attacks involving malicious files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources. Monitor Adobe's security advisories for updates regarding patches or mitigations.