Substance 3D Painter CVE-2026-75767

Exploitation requires the victim to actively open a specially crafted malicious file in Adobe Substance 3D Painter - this mandatory user interaction is confirmed by both the CVE description and the CVSS UI:R metric. The attack vector is local (AV:L), meaning the malicious file must be present on or accessible from the victim's filesystem; there is no network-facing remote attack path without prior file delivery. No authentication is required of the attacker (PR:N), but a delivery mechanism - phishing, shared repositories, or malicious asset distribution - is necessary to place the file in the victim's path. Exploitation is bounded by: mandatory active user interaction (opening the file), local-only attack vector (no unauthenticated network exposure), and an unchanged scope (S:U) confining impact to the current user's privileges with no path to automatic privilege escalation.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.8 High, reflecting that exploitation is local (the malicious file must be opened on the victim's machine), complexity is low once the file is delivered, no privileges are required of the attacker, but user interaction is mandatory. The local attack vector here is consistent with a file-parsing flaw rather than a network-reachable service - there is no unauthenticated remote network exposure. No EPSS score was available, limiting quantitative exploitation probability assessment. Neither a CISA KEV listing nor a known public proof-of-concept has been identified at time of analysis. Real-world risk is elevated for organizations in creative industries - game studios and VFX pipelines - where Substance 3D Painter project files are routinely shared with external contractors, freelancers, and asset marketplaces, creating a meaningful social engineering attack surface. The scope is unchanged (S:U), meaning successful exploitation does not grant privilege escalation beyond the current user.

An attacker crafts a malicious Substance 3D Painter project file embedding a heap overflow payload and distributes it to target users in a game studio or VFX house via email, a shared cloud asset repository, or a spoofed marketplace listing. When the victim opens the file in Substance 3D Painter, the heap buffer overflow is triggered during parsing, overwriting heap structures to redirect code execution to attacker-controlled instructions. The attacker gains arbitrary code execution under the victim's user account, enabling credential theft, lateral movement within the studio network, or deployment of ransomware. No public proof-of-concept has been identified at time of analysis.