EUVD-2026-111115
GHSA-r5mh-73m6-x292
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious asset file to victim
-
ExploitVictim opens file in Substance 3D Painter
-
ExecutionOut-of-bounds read during file parsing
-
ImpactSensitive process memory disclosed
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a malicious file in Adobe Substance 3D Painter (the file format/feature that triggers the out-of-bounds read is not specified in the available sources). Because the CVSS vector is AV:L with UI:R and PR:N, the attack is local and unauthenticated but strictly gated by user interaction - there is no remote or network-triggerable path and no automated/unattended exploitation. Impact is limited to confidentiality (C:H, I:N, A:N): memory disclosure only, with no code execution, modification, or denial of service established by the evidence. The affected population is users running Adobe Substance 3D Painter at or below version 12.1.5. |
| Impact | This is a moderate-severity, file-parsing information disclosure flaw (CWE-125 out-of-bounds read) in Adobe Substance 3D Painter, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) describes a local attack requiring victim interaction, with high confidentiality impact but no integrity or availability impact - i.e., memory disclosure only. No EPSS score, KEV listing, or PoC reference was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with a user-interaction-gated, local, confidentiality-only issue. Real-world priority is accordingly limited: this is not a remotely wormable or automatable bug, and exploitation hinges on a victim opening an attacker-supplied file. It is a genuine patch-this-cycle item for shops running the affected product, but not a drop-everything emergency. Note that the 'Buffer Overflow' tag overstates mechanism - the described flaw is an out-of-bounds read (disclosure), not a memory-corruption/write overflow. |
| Exploit ScenarioDerived | An attacker crafts a malicious project, texture, or asset file and delivers it to a 3D artist (e.g., via a shared project, marketplace asset, or email) who opens it in Substance 3D Painter. When the application parses the malformed file, an out-of-bounds read exposes adjacent process memory, which the attacker can leverage to disclose sensitive information. No public exploit code was provided in the available sources, and the trigger within the file format is not described beyond 'open a malicious file'. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An out-of-bounds read (CWE-125) in Adobe Substance 3D Painter, affecting releases up to and including 12.1.5, can leak sensitive contents of process memory when a user opens a crafted file. It is scored CVSS 5.5 (AV:L/AC:L/PR:N/UI:R, confidentiality-only impact), meaning disclosure is gated by a local, unauthenticated attacker plus a victim opening a malicious asset; there is no network-triggerable path and no code execution, data modification, or denial of service is established. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the vuln.today priority decision is 'this_month'.
RemediationAI
The supplied sources do not state a fixed release version for this CVE, so the authoritative source for the patched build is Adobe advisory APSB26-178 (https://www.adobe.com/trust/security/products/substance3d-painter/apsb26-178.html); confirm the exact fixed version there and upgrade Substance 3D Painter to it or later, since no vendor workaround is documented in the available data. Patch availability therefore cannot be asserted from this evidence set - treat the advisory as the gating reference rather than assuming no fix exists. In the interim, the only exposure-reduction consistent with the confirmed preconditions (a local, unauthenticated attacker plus a victim opening a malicious file) is to avoid opening project, asset or texture files received from untrusted or unverified sources and to keep file-association handling of such content within trusted workflows; the trade-off is reduced collaboration/ingestion flexibility for externally supplied assets, and this does not remove the underlying defect. No configuration setting, feature toggle, port restriction or endpoint control is identified in the evidence as a complete mitigation, and confidentiality impact is high (memory disclosure) with no integrity or availability effect confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-125, an out-of-bounds read: the application reads past the end of an allocated buffer, so bytes belonging to adjacent memory can surface in the application's output or error state instead of the expected file data. In a 3D content-creation tool such as Substance 3D Painter this class of defect typically sits in asset/project parsing, where a size or offset taken from the file is used without confirming it against the actual buffer length; however, the specific file format, parser component and code path that trigger the over-read are not described in the available sources, so the concrete trigger remains unverified. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N describes severity rather than mechanism: the attack is local and unauthenticated but strictly requires the victim to open the malicious file, scope is unchanged, and the only established impact is high confidentiality loss (memory disclosure) with no integrity or availability effect confirmed. The Adobe CPE cpe:2.3:a:adobe:adobe_substance_3d_painter identifies the affected product family across all platform builds; no version-specific behavior differences are documented in the supplied sources.
Know when Adobe Substance 3D Painter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Trigger is opening a local malicious file, so AV:L with UI:R and PR:N; out-of-bounds read discloses memory giving C:H, with no I or A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Adobe Substance 3D Painter
View allStack-based buffer overflow in Adobe Substance 3D Painter up to and including 12.1.5 allows arbitrary code execution in
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution under the logged-in user's con
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution within the context of the curr
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution in the context of the current
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution at the privilege level of the
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution under the privileges of the current u
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution within the current user's security co
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafte
Exploit-DB