Substance 3D Painter EUVD-2026-65685

Exploitation requires that the victim user actively open a malicious file within Adobe Substance 3D Painter - this is the sole and mandatory precondition (UI:R). No special system configuration, elevated privileges, or network-exposed service is required. The attack vector is Local (AV:L), meaning the malicious file must be present on or delivered to the target host and opened by the application; remote-over-network exploitation without file delivery is not applicable. Exploitation is bounded by the privilege level of the logged-in user (S:U, no scope change), so the attacker cannot automatically escalate beyond the victim's account. Non-default configuration or administrative access is not required on the victim system.

The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects a file-borne code-execution flaw: attack vector is Local (file must execute on the target system), complexity is Low once the file is opened, no prior privileges are required of the attacker, but user interaction is mandatory. The full C:H/I:H/A:H triad follows from arbitrary code execution in the user context. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. The absence of a CISA KEV entry and no reported public POC suggests this is not yet actively exploited at scale. Real-world risk is moderate-to-high for organizations with Substance 3D Painter users who receive files from external parties (freelancers, asset marketplaces), as social engineering is the primary delivery mechanism. SSVC signals: exploitation status unconfirmed, automatable only if delivery is automatable (possible via phishing), technical impact is total for the affected user.

An attacker crafts a malicious Substance 3D Painter project file containing oversized or malformed data designed to overflow a heap buffer during parsing, then delivers it to a target artist or developer via email, a shared asset library, or a compromised file-sharing platform. When the victim opens the file in Substance 3D Painter, the overflow corrupts heap metadata and redirects execution to attacker-controlled shellcode, resulting in code execution as the current user. No public POC has been identified, but heap overflow exploitation in file parsers is a well-understood technique with documented public methodologies.