EUVD-2026-65687
GHSA-chrc-jvf9-2396
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local attack vector reflects file-system staging requirement; no attacker privileges needed; mandatory user file-open interaction; full C/I/A impact within unchanged user scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution under the current user's account by planting a malicious DLL or executable alongside a crafted project file. The root cause (CWE-426) is the application's failure to validate the library search path when loading dependencies at runtime, enabling full compromise of confidentiality, integrity, and availability on the victim host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: first, the victim must actively open a specially crafted Substance 3D Painter project file (UI:R per CVSS vector); second, the attacker must have pre-positioned a malicious DLL or executable - named to match a library Painter loads - in a directory that Painter searches during dependency resolution, such as the project file's containing directory or the application working directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 base score reflects a high-impact but locally-triggered attack: AV:L bounds the attack to situations where the attacker can place files in a path Substance 3D Painter searches, while UI:R requires a victim to actively open a crafted project file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker distributes a crafted Substance 3D Painter project file paired with a malicious DLL named to match a library the application loads at startup - delivered via email, a shared asset repository, or a compromised collaboration platform. When a victim artist opens the project file from the directory containing the malicious DLL, Painter's library loader resolves the library name to the attacker's substitute rather than the legitimate system copy, executing arbitrary code silently under the victim's account. … |
| Remediation | Apply the vendor-released fix detailed in Adobe Security Bulletin APSB26-129 at https://helpx.adobe.com/security/products/substance3d_painter/apsb26-129.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: notify users that Substance 3D Painter has a critical code execution vulnerability and restrict opening of project files from untrusted external sources, with enforcement via email communication to creative and design teams. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Substance 3D Painter
View allHeap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution under the logged-in user's con
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution within the context of the curr
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution in the context of the current
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution at the privilege level of the
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution under the privileges of the current u
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution within the current user's security co
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafte
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today