Substance 3D Painter EUVD-2026-65686

Exploitation requires that the victim open a malicious file in Adobe Substance 3D Painter - this is the sole prerequisite. The CVSS vector PR:N confirms no authentication or elevated privilege on the system is required by the attacker. The limiting factor is UI:R: exploitation cannot be triggered remotely without the user actively opening the crafted file, making drive-by or automated mass exploitation unlikely. The attack is local in execution context (AV:L), meaning the malicious file must reach the victim's filesystem and be opened in Painter; network exploitation of a listening service is not applicable. No specific non-default configuration or feature flag is required - any installation of Substance 3D Painter that opens the malicious file is vulnerable.

The CVSS 7.8 High score is internally consistent: AV:L reflects file-based delivery, AC:L indicates no complex preconditions, PR:N means the attacker needs no system privileges, and UI:R acknowledges that a victim must actively open the malicious file. The full C:H/I:H/A:H impact reflects that arbitrary code execution gives the attacker complete control within the user's session. EPSS data is not present in the provided intelligence, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no POC has been identified, meaning real-world exploitation is not confirmed. The practical risk is concentrated in creative-industry workstations where artists routinely open files from external collaborators, online marketplaces, or client-supplied assets - an attacker delivering a malicious .spp or project file through a trusted exchange channel could bypass typical perimeter defenses entirely. The absence of network exposure limits opportunistic mass exploitation, but targeted attacks against studios or individual artists are plausible.

An attacker crafts a malicious Substance 3D Painter project file that triggers a heap-based buffer overflow in the application's file parser. The file is delivered to a target artist or studio via a plausible vector such as a freelance job submission, an asset marketplace download, or a phishing email disguised as a client project. When the victim opens the file in Painter, the overflow corrupts heap structures and redirects execution to attacker-controlled shellcode, achieving arbitrary code execution with the victim's user privileges. No public POC has been identified, but the attack requires only that the victim open the file - no further interaction is needed after that.