CVE-2026-100130 Adobe CVE debrief

Who should care

Defenders responsible for managing and securing Adobe Substance 3D Sampler installations, particularly in environments where user interaction with potentially malicious files is a concern, should prioritize verifying and patching vulnerable installations.

Why it matters

CVE-2026-100130 is a medium-severity vulnerability in Adobe Substance 3D Sampler that allows an out-of-bounds read, potentially leading to sensitive memory disclosure. Defenders should prioritize verifying and patching vulnerable installations, especially in environments where user interaction with potentially malicious files is a concern.

• Verify patch deployment for vulnerable Substance 3D Sampler versions.
• Restrict user interaction with potentially malicious files to minimize exposure.
• Monitor Substance 3D Sampler installations for updates and vulnerabilities.

Technical summary

The vulnerability is caused by an out-of-bounds read in Adobe Substance 3D Sampler, which could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information, requiring user interaction to open a malicious file. The CVSS score for this vulnerability is 5.5, indicating a medium severity level. The vulnerability affects Adobe Substance 3D Sampler versions prior to 6.0.4. Defenders should prioritize verifying and patching vulnerable installations, especially in environments where user interaction with potentially malicious files is a concern.

Defensive priority

Defenders should prioritize verifying and patching vulnerable Substance 3D Sampler installations, especially in environments where user interaction with potentially malicious files is a concern.

Recommended defensive actions

• Verify and apply the vendor-provided patch (APSB26-159) for Substance 3D Sampler.
• Restrict user interaction with potentially malicious files.
• Monitor Substance 3D Sampler installations for updates and vulnerabilities.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and associated source item provide details on the vulnerability, including its CVSS score of 5.5 and the affected versions of Substance 3D Sampler (prior to 6.0.4). The vulnerability is caused by an out-of-bounds read in Adobe Substance 3D Sampler, which could lead to disclosure of sensitive memory. The CVE Program record and NIST NVD detail page provide additional information on the vulnerability. The vendor advisory APSB26-159 provides guidance on patching vulnerable installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.