Substance 3D Painter EUVD-2026-65682

Exploitation requires a victim user to manually open a malicious file using Adobe Substance 3D Painter (UI:R). The attack vector is local (AV:L): the crafted file must be present on the victim's filesystem or accessible via a mounted share and opened through the application. No authentication or elevated privileges are required of the attacker (PR:N) - only the ability to deliver the malicious file and socially engineer the victim into opening it. Exploitation is limited to the current user's privilege context (S:U), meaning post-exploitation impact is bounded to that user's accessible files and sessions. Non-default configurations are not required; any standard installation of Substance 3D Painter that can open project or asset files is vulnerable. The primary limiting factor is the mandatory user interaction step - automated or unauthenticated remote exploitation without file-open interaction is not possible given the AV:L/UI:R vector.

The CVSS 7.8 High score with AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately represents the risk profile: full system impact (C:H/I:H/A:H) on the vulnerable system but constrained by the requirement for local user interaction (UI:R). No EPSS data was supplied in the intelligence package, preventing a probabilistic exploitation comparison. The absence of a CISA KEV listing and no noted POC means exploitation status is currently 'no public exploit identified at time of analysis' - however, file-format RCE vulnerabilities in creative software are historically weaponized through targeted phishing against designers and studio personnel, making the practical risk higher than a raw EPSS percentile might reflect. The low attack complexity (AC:L) once a victim opens the file suggests that exploit development - if pursued - would not require unusual technical barriers. The unchanged scope (S:U) limits lateral blast radius to the current user context, which is a mitigating factor in enterprise environments with privilege separation. Overall, this is a credible and high-severity threat in targeted scenarios against its specific user population, but not a broadly automated exploitation risk in its current state.

An attacker crafts a maliciously structured Substance 3D Painter project or asset file designed to trigger an out-of-bounds write in the application's file parser. The file is delivered to a target - likely a 3D artist, game developer, or VFX professional - via email, a compromised asset-sharing platform, or a poisoned online asset library. Upon opening the file, the OOB write corrupts memory in a way that redirects execution, allowing the attacker to run arbitrary code silently under the victim's user account with no further interaction required.