EUVD-2026-29619
GHSA-q576-89xv-9327
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no attacker privileges (PR:N); out-of-bounds write yields full code execution in the user context (C:H/I:H/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance 3D Painter (versions 12.0.2 and earlier) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, so exploitation is file-borne and requires user interaction. There is no public exploit identified at time of analysis, KEV does not list it, and the EPSS score is very low (0.03%), indicating no observed or expected mass exploitation.
Technical ContextAI
Substance 3D Painter is Adobe's 3D texture-painting application, widely used in game development, VFX, and product design pipelines to author PBR materials and export texture maps. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application writes past the bounds of an allocated buffer - typically because a length, offset, or index derived from untrusted file data is not validated before a write operation. The CPE cpe:2.3:a:adobe:substance_3d_painter:*:*:*:*:*:*:*:* confirms the affected product is the desktop application itself (not a plugin or server), and the tags Memory Corruption / Buffer Overflow / RCE align with a heap or stack out-of-bounds write reachable through the file-import/project-parsing path. Corrupting adjacent memory in this way can overwrite control data (function pointers, return addresses, or object vtables), which is what enables control-flow hijack and code execution.
RemediationAI
Vendor-released patch: upgrade Substance 3D Painter to the fixed release identified in Adobe security bulletin APSB26-55 (https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html) - apply the version listed there as the successor to 12.0.2, since the input data confirms the fix without pinning an exact build number, so verify the exact patched version against the Adobe bulletin before deploying. Because exploitation requires opening a malicious file, the most effective compensating control until patching is to treat Substance 3D Painter project files and imported assets (.spp, meshes, textures) from untrusted or external sources as dangerous: only open files from known-good origins, and route third-party assets through review or a sandboxed/isolated workstation before opening them in a production environment. Where feasible, run the application under a least-privileged user account so that code execution occurs in a low-privilege context, limiting downstream impact - the trade-off being reduced convenience for artists who need broader local permissions. Avoid double-clicking or auto-opening asset files delivered via email, chat, or shared drives.
More in Substance 3d Painter
View allSubstance3D - Painter versions 11.0 and earlier are affected by an out-of-bounds write vulnerability that could result i
CVE-2025-47108 is an out-of-bounds write vulnerability in Adobe Substance3D Painter versions 11.0.1 and earlier that all
Arbitrary code execution in Adobe Substance 3D Painter versions 11.0.3 and earlier through an out-of-bounds write flaw a
Arbitrary code execution in Adobe Substance 3D Painter versions 12.0.2 and earlier arises from an out-of-bounds write (C
Substance3D - Painter versions 10.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Painter versions 10.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could
Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could
Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could
Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today