Substance 3D Painter CVE-2026-75768

Exploitation requires two concrete prerequisites: first, the victim must actively open a specially crafted Substance 3D Painter project file (UI:R per CVSS vector); second, the attacker must have pre-positioned a malicious DLL or executable - named to match a library Painter loads - in a directory that Painter searches during dependency resolution, such as the project file's containing directory or the application working directory. No authentication or system-level privileges are required of the attacker (PR:N per CVSS vector). Exploitation is bounded by the victim's account privilege level (S:U, no escalation beyond the current user context). The vulnerability does not affect installations where users exclusively open project files from fully trusted, write-controlled directories, and it cannot be triggered remotely without the file-open interaction step.

The CVSS 7.8 base score reflects a high-impact but locally-triggered attack: AV:L bounds the attack to situations where the attacker can place files in a path Substance 3D Painter searches, while UI:R requires a victim to actively open a crafted project file. PR:N is notable - it confirms that the attacker does not need any pre-existing privileges on the victim system, only the ability to deliver a file pair. The unchanged scope (S:U) limits the blast radius to the victim's own user account, yet C:H/I:H/A:H confirms full host-level impact within that account's privilege boundary. No EPSS score was included in available data, so exploitation probability cannot be quantified numerically; no CISA KEV listing exists, meaning active exploitation is unconfirmed. The attack technique for CWE-426 is well-documented, low-skill, and does not require specialized tooling, which means the effective exploitation bar is lower than the CVSS complexity metrics alone might suggest - any creative or digital-production environment whose users regularly exchange Substance 3D Painter project files with external collaborators should treat this as an urgent workstation patch.

An attacker distributes a crafted Substance 3D Painter project file paired with a malicious DLL named to match a library the application loads at startup - delivered via email, a shared asset repository, or a compromised collaboration platform. When a victim artist opens the project file from the directory containing the malicious DLL, Painter's library loader resolves the library name to the attacker's substitute rather than the legitimate system copy, executing arbitrary code silently under the victim's account. No public POC has been identified at time of analysis, but the DLL side-loading technique underlying CWE-426 requires no specialized tooling and is well-documented in open security research.