CVE-2026-83966: Out-of-bounds Write (CWE-787) in Adobe Substance 3D Sampler

CVE-2026-83966 is an out-of-bounds write vulnerability in Adobe Substance 3D Sampler that may lead to arbitrary code execution in the context of the current user. Successful exploitation requires the victim to open a specially crafted malicious file. The vulnerability affects versions from the initial release up to 6.0.3 inclusive. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with attack vector local, low attack complexity, no privileges required, and user interaction required.

If exploited, an attacker could execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected system within the user's context. The attack requires user interaction, limiting remote exploitation but still posing a significant risk if a user opens a malicious file.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted files with Adobe Substance 3D Sampler.