Adobe Substance 3D Painter EUVD-2026-111116

Exploitation requires a victim running Adobe Substance 3D Painter (version up to and including 12.1.5) to open an attacker-supplied malicious file, which triggers the stack-based buffer overflow during file processing. The specific file format or parsing component that triggers the overflow is not described in the available sources. Limiting factors: the vector is local (AV:L) rather than remote network-reachable, and mandatory user interaction (UI:R) is required - the attacker cannot trigger the flaw without the user opening the crafted file - which significantly constrains mass exploitation and favors targeted social-engineering delivery. Code executes only with the privileges of the current user, not elevated.

This is a genuine but not emergency-priority issue, consistent with the vuln.today 'this_week' decision label rather than act_now/emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, user-interaction-dependent flaw: the attack vector is LOCAL because exploitation occurs when the victim opens a malicious file, not over a network, and UI:R confirms required user interaction. Impact is high across confidentiality, integrity, and availability because successful exploitation yields arbitrary code execution in the context of the current user. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no proof-of-concept or exploit reference appears in the input - only Adobe's advisory and the NVD detail page. Therefore there is no public exploit identified at time of analysis and no evidence of active exploitation; risk is driven by the high local impact and the realistic social-engineering delivery (malicious file), not by observed in-the-wild activity. The main uncertainty is EPSS (missing) and the absence of an independently confirmed fixed version string in the supplied data.

An attacker crafts a malicious project or asset file and delivers it to a Substance 3D Painter user via email, a shared asset pack, or a download. When the victim opens the file, a stack-based buffer overflow (CWE-121) is triggered during parsing, leading to arbitrary code execution in the context of the current user. No public exploit code was identified in the available data, and exploitation depends on the victim opening the attacker-supplied file (UI:R).