Server-Side Request Forgery (SSRF) in Adobe Substance 3D Designer - CVE-2026-34664
Published: May 21, 2026
Vulnerability identifier: #VU132092
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-34664
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read arbitrary files.
The vulnerability exists due to server-side request forgery in Adobe Substance 3D Designer when processing attacker-controlled content. A remote attacker can supply crafted input to trigger arbitrary file system read.
User interaction is required to open or process crafted content.
Affected software
Adobe Substance 3D Designer
How to mitigate CVE-2026-34664
Install security update from vendor's website.
Adobe Substance 3D Designer - update to 16.0.1