Substance 3D Painter EUVD-2026-65689

Exploitation requires that a victim user actively open a malicious file in Adobe Substance 3D Painter - the CVSS UI:R metric confirms this mandatory user interaction as a hard prerequisite. The local attack vector (AV:L) means the crafted file must reside on the victim's filesystem or a mounted share; there is no direct network exploitation path against the application. PR:N indicates no special system privileges are needed on the attacker's side to craft or deliver the file. The unchanged scope (S:U) limits the impact to the victim's current user context - the vulnerability alone does not provide a path to system or administrator privileges. No specific non-default configuration setting or application feature flag is identified as a prerequisite in the available data; any user who opens a malicious file in an affected version is exposed.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local, file-triggered attack requiring no special privileges but mandatory user interaction. High C/I/A impact captures full user-context compromise, while S:U constrains the blast radius to that user's session - lateral privilege escalation is outside the defined scope of this CVE. The CVE is not listed in CISA KEV, and no public POC is referenced in the input data, placing this in the 'theoretically exploitable but not actively abused' category at time of analysis. For creative studios where Substance 3D Painter is a standard toolchain component and project files are routinely shared across teams, vendors, and contractors, that file-exchange workflow constitutes a realistic social engineering surface that elevates practical risk beyond what the AV:L label alone might suggest. EPSS data is absent from the provided intelligence; exploitation probability relative to the broader CVE population cannot be quantified without it. The CVSS vector is internally consistent with the description and no contradictions between data sources are apparent.

An attacker crafts a malicious Substance Painter project file or supported import format containing oversized or malformed data engineered to overflow the heap buffer in the application's file parser. The file is delivered to a target artist or technical director via email, a shared collaboration platform, or a contractor file-exchange workflow under the guise of a legitimate project asset. When the victim opens the file in Substance 3D Painter, the parser overflows the allocated buffer, corrupts adjacent heap memory, and redirects execution to attacker-controlled code running under the victim's user account. No public POC has been identified, so this scenario reflects the theoretical exploit path consistent with CWE-122 and the CVSS vector.