CVE-2026-21299
Published: 13 January 2026
Summary
CVE-2026-21299 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Modeler. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21299 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Modeler versions 1.22.4 and earlier. Published on 2026-01-13, the issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and can result in arbitrary code execution within the context of the current user.
The vulnerability can be exploited by an attacker who tricks a victim into opening a malicious file using the affected software. This local attack vector requires low complexity and no special privileges, but depends on user interaction. Successful exploitation enables the attacker to compromise confidentiality, integrity, and availability at a high level.
Adobe Security Bulletin APSB26-08 addresses this vulnerability and is available at https://helpx.adobe.com/security/products/substance3d-modeler/apsb26-08.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2042
Vulnerability details
Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in desktop application directly enables client-side code execution via malicious file opened by user (T1204.002 + T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws like the out-of-bounds write in Substance3D Modeler via vendor patches, directly preventing exploitation.
Mandates regular vulnerability scanning to identify deployments of vulnerable Substance3D Modeler versions affected by CVE-2026-21299.
Implements memory protection mechanisms such as ASLR and DEP to hinder arbitrary code execution from the out-of-bounds write vulnerability.