Adobe Substance 3D Painter
Monthly
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution under the logged-in user's context when a victim opens a specially crafted malicious file. The vulnerability (CWE-122) affects all tracked versions per the wildcard CPE, with Adobe acknowledging the issue via advisory APSB26-129. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution within the context of the current user when a victim opens a specially crafted malicious file. The CVSS 7.8 (High) score reflects local attack vector with no required privileges but mandatory user interaction, making social engineering the primary delivery mechanism for exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high-impact C:H/I:H/A:H triad and RCE potential make patching a priority for affected creative industry environments.
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution under the current user's account by planting a malicious DLL or executable alongside a crafted project file. The root cause (CWE-426) is the application's failure to validate the library search path when loading dependencies at runtime, enabling full compromise of confidentiality, integrity, and availability on the victim host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity, well-understood exploitation technique, and complete C/H/I/A/A impact triad make this a meaningful patching priority for teams whose users open externally sourced project files.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution in the context of the current user when a victim opens a specially crafted file. The flaw (CWE-122) arises during malicious file parsing, covering all versions per the wildcard CPE. Adobe has published advisory APSB26-129. No public exploit or CISA KEV listing has been identified at time of analysis, but the High CVSS score and full CIA triad impact make this a meaningful risk for creative and game-development environments.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution at the privilege level of the victim user when a maliciously crafted file is opened. All versions are affected per the wildcard CPE, and Adobe has published advisory APSB26-129 addressing this issue. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the file-open attack vector makes this highly amenable to phishing and supply-chain-style delivery.
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution within the current user's security context via a maliciously crafted file. The flaw (CWE-787) is triggered during file parsing, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafted malicious file. The flaw, classified as CWE-125, causes the application to read beyond allocated buffer boundaries during file parsing, potentially leaking in-memory data such as credentials or session tokens accessible to the attacker. Adobe has published security advisory APSB26-129 addressing the issue; no public exploit code has been identified at time of analysis.
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution under the privileges of the current user when a victim opens a specially crafted malicious file. The flaw (CWE-787) resides in file-parsing logic and delivers full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but the file-delivery vector makes this a credible threat for spear-phishing campaigns targeting creative and game-development professionals.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution under the logged-in user's context when a victim opens a specially crafted malicious file. The vulnerability (CWE-122) affects all tracked versions per the wildcard CPE, with Adobe acknowledging the issue via advisory APSB26-129. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution within the context of the current user when a victim opens a specially crafted malicious file. The CVSS 7.8 (High) score reflects local attack vector with no required privileges but mandatory user interaction, making social engineering the primary delivery mechanism for exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high-impact C:H/I:H/A:H triad and RCE potential make patching a priority for affected creative industry environments.
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution under the current user's account by planting a malicious DLL or executable alongside a crafted project file. The root cause (CWE-426) is the application's failure to validate the library search path when loading dependencies at runtime, enabling full compromise of confidentiality, integrity, and availability on the victim host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity, well-understood exploitation technique, and complete C/H/I/A/A impact triad make this a meaningful patching priority for teams whose users open externally sourced project files.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution in the context of the current user when a victim opens a specially crafted file. The flaw (CWE-122) arises during malicious file parsing, covering all versions per the wildcard CPE. Adobe has published advisory APSB26-129. No public exploit or CISA KEV listing has been identified at time of analysis, but the High CVSS score and full CIA triad impact make this a meaningful risk for creative and game-development environments.
Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution at the privilege level of the victim user when a maliciously crafted file is opened. All versions are affected per the wildcard CPE, and Adobe has published advisory APSB26-129 addressing this issue. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the file-open attack vector makes this highly amenable to phishing and supply-chain-style delivery.
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution within the current user's security context via a maliciously crafted file. The flaw (CWE-787) is triggered during file parsing, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafted malicious file. The flaw, classified as CWE-125, causes the application to read beyond allocated buffer boundaries during file parsing, potentially leaking in-memory data such as credentials or session tokens accessible to the attacker. Adobe has published security advisory APSB26-129 addressing the issue; no public exploit code has been identified at time of analysis.
Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution under the privileges of the current user when a victim opens a specially crafted malicious file. The flaw (CWE-787) resides in file-parsing logic and delivers full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but the file-delivery vector makes this a credible threat for spear-phishing campaigns targeting creative and game-development professionals.