EUVD-2026-29620
GHSA-6hr9-7v6j-hv4m
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open attack (AV:L, UI:R) needing no attacker privileges (PR:N); successful memory corruption yields full code execution, so C/I/A all High.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Substance 3D Painter versions 12.0.2 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, executing code in the context of the current user. The flaw was reported by Adobe PSIRT and is fixed per advisory APSB26-55; there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.03%. Exploitation is local and requires user interaction, limiting it to social-engineering-driven file-opening attacks rather than remote automated compromise.
Technical ContextAI
Substance 3D Painter is Adobe's 3D texture-painting application, widely used in game development, VFX, and product design pipelines to author materials on 3D assets. The root cause is CWE-787 (Out-of-bounds Write): while parsing an untrusted input file, the application writes data past the bounds of an allocated buffer, corrupting adjacent memory. The vendor-supplied tags (Memory Corruption, Buffer Overflow, RCE) confirm this is a classic memory-safety defect in the file/asset parsing path. Controlled heap or stack corruption of this type can be leveraged to hijack control flow and achieve code execution. The single affected CPE is cpe:2.3:a:adobe:substance_3d_painter, indicating the desktop application itself rather than a shared library or plugin.
RemediationAI
Vendor-released patch: upgrade Substance 3D Painter to the fixed release published in Adobe advisory APSB26-55 (https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html), which supersedes vulnerable version 12.0.2 and earlier - apply the update via the Adobe Creative Cloud desktop app. Because exploitation depends entirely on opening a malicious file, the most effective compensating control until patching is to refuse to open Substance project or asset files (.spp, textures, meshes) from untrusted or unverified sources, and to open suspect files only in an isolated/sandboxed workstation with no sensitive data or network access; the trade-off is disrupted collaboration workflows where assets are routinely shared. Consuming assets only from trusted internal pipelines and validating third-party marketplace content before import further reduces exposure without functional loss.
More in Substance 3d Painter
View allSubstance3D - Painter versions 11.0 and earlier are affected by an out-of-bounds write vulnerability that could result i
CVE-2025-47108 is an out-of-bounds write vulnerability in Adobe Substance3D Painter versions 11.0.1 and earlier that all
Arbitrary code execution in Adobe Substance 3D Painter versions 11.0.3 and earlier through an out-of-bounds write flaw a
Arbitrary code execution in Adobe Substance 3D Painter (versions 12.0.2 and earlier) allows an attacker to run code in t
Substance3D - Painter versions 10.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Painter versions 10.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could
Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could
Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could
Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today