Substance 3D Painter CVE-2026-75752

Exploitation requires that the victim actively open a malicious file using Adobe Substance 3D Painter - this is the sole and mandatory prerequisite, reflected in UI:R in the CVSS vector. No elevated privileges are needed by the attacker prior to file delivery (PR:N), and no special non-default application configuration is required; any standard installation is vulnerable when presented with a crafted file. The primary factor limiting exploitation is the mandatory user interaction: the attack cannot succeed remotely without a social-engineering or supply-chain delivery step to induce the victim to open the file. The local attack vector (AV:L) further requires the malicious file to reach the victim's machine before exploitation can occur. Exploitation is bounded to memory disclosure within the Substance Painter process (S:U) and does not provide code execution or affect integrity or availability.

The CVSS 5.5 Medium rating accurately characterizes the real-world priority of this vulnerability: the local attack vector (AV:L) requires a victim to open a crafted file, no attacker privileges are needed prior to delivery (PR:N), but mandatory user interaction (UI:R) is the primary friction point. EPSS data is absent from available intelligence, precluding a probability-of-exploitation comparison against similar disclosures. KEV status is not listed and no proof-of-concept code has been identified, both consistent with a disclosure-class vulnerability that lacks a code-execution primitive and therefore attracts less immediate threat-actor interest. The high confidentiality impact (C:H) is the primary concern - depending on what is resident in Substance Painter process memory, an attacker could recover sensitive data from a targeted creative professional's workstation, including in-memory credentials or proprietary asset data. Integrity and availability are wholly unaffected (I:N/A:N), ruling out ransomware or persistence use cases via this flaw alone. Overall, this is a genuine but moderate-priority issue that warrants patching within a normal maintenance cycle rather than emergency response.

An attacker crafts a malicious Substance 3D Painter project file or compatible import asset and delivers it to a target via spear-phishing email, a compromised file-sharing service, or a poisoned collaboration asset library commonly used by 3D artists. When the victim opens the file in Substance Painter, the out-of-bounds read is triggered during parsing and sensitive process memory - potentially including in-memory API keys, credentials, or proprietary texture data - is disclosed. No public proof-of-concept exploit has been identified at time of analysis, but the attack chain requires no technical sophistication beyond crafting the malicious file.