CVE-2026-34683 — Code Execution

title: CVE-2026-34683 - Substance3D Designer Out-of-Bounds Write Leading to Code Execution
id: scw-2026-05-12-ai-1
status: experimental
level: high
description: |
  Detects the execution of Substance3D Designer (Designer.exe) when processing potentially malicious 3D model files (.3ds, .obj, .stl) that are opened via common user interaction vectors like Microsoft Word, Outlook, or Adobe Reader. This specific pattern targets the described out-of-bounds write vulnerability (CVE-2026-34683) requiring user interaction to open a malicious file.
author: SCW Feed Engine (AI-generated)
date: 2026-05-12
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-34683/
tags:
  - attack.execution
  - attack.t1204.002
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - 'Designer.exe'
      CommandLine|contains:
          - '.3ds'
          - '.obj'
          - '.stl'
      ParentImage|contains:
          - 'winword.exe'
          - 'outlook.exe'
          - 'acrord32.exe'
  selection_condition: selection
  condition: selection_condition
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse