CVE-2026-21365: Adobe Substance 3D Painter Info Disclosure

CVE-2026-21365 Overview

CVE-2026-21365 is an out-of-bounds read vulnerability affecting Adobe Substance 3D Painter versions 11.1.2 and earlier. This vulnerability allows attackers to read data beyond the intended memory boundaries, potentially exposing sensitive information stored in the application's memory space. Successful exploitation requires user interaction, specifically tricking a victim into opening a maliciously crafted file.

Critical Impact

Attackers can leverage this vulnerability to access sensitive information stored in memory, potentially exposing credentials, encryption keys, or other confidential data processed by the application.

Affected Products

• Adobe Substance 3D Painter versions 11.1.2 and earlier
• All platforms running vulnerable Substance 3D Painter versions

Discovery Timeline

• March 10, 2026 - CVE-2026-21365 published to NVD
• March 11, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21365

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption issue that occurs when the application reads data from memory locations outside the intended boundaries of a buffer. In the context of Adobe Substance 3D Painter, this flaw allows an attacker to craft a malicious file that, when opened by a victim, causes the application to read memory beyond allocated buffers.

The out-of-bounds read condition can expose sensitive application data including memory contents, potentially revealing encryption keys, session tokens, or other confidential information processed by the 3D painting software. While this vulnerability primarily leads to information disclosure rather than code execution, the leaked memory contents could facilitate further attacks against the system or user.

Root Cause

The vulnerability stems from insufficient boundary validation when processing file contents in Adobe Substance 3D Painter. When the application parses specially crafted input files, it fails to properly validate array indices or buffer sizes before performing read operations. This lack of bounds checking allows memory reads to extend beyond the allocated buffer, accessing adjacent memory regions that may contain sensitive data.

Attack Vector

The attack vector requires local access and user interaction. An attacker must craft a malicious file (likely a Substance Painter project file or supported import format) and convince the victim to open it. Common delivery methods include:

• Phishing emails with malicious file attachments disguised as legitimate 3D assets
• Compromised file-sharing platforms hosting poisoned project files
• Supply chain attacks targeting shared asset libraries used by design teams

When the victim opens the malicious file in Substance 3D Painter, the vulnerability triggers during file parsing, causing the application to read beyond buffer boundaries and potentially expose memory contents to the attacker through error messages, logs, or crafted exfiltration channels embedded in the malicious file structure.

Detection Methods for CVE-2026-21365

Indicators of Compromise

• Unexpected crashes or abnormal behavior in Adobe Substance 3D Painter after opening files from untrusted sources
• Presence of suspicious .spp, .spt, or other Substance Painter file formats from unknown origins in recent file access logs
• Memory access violation errors in application logs when processing specific files

Detection Strategies

• Monitor for Adobe Substance 3D Painter versions 11.1.2 or earlier in software inventory systems
• Implement file integrity monitoring for Substance Painter project files received from external sources
• Deploy endpoint detection rules to flag memory access anomalies in creative application processes
• Use application sandboxing to isolate Substance 3D Painter from sensitive system resources

Monitoring Recommendations

• Enable verbose logging for Adobe Substance 3D Painter to capture file processing events
• Monitor network traffic from Substance 3D Painter processes for unusual data exfiltration patterns
• Implement alerting for users opening Substance Painter files from email attachments or untrusted downloads
• Review crash dumps and error reports from Substance 3D Painter for signs of exploitation attempts

How to Mitigate CVE-2026-21365

Immediate Actions Required

• Update Adobe Substance 3D Painter to the latest patched version immediately
• Restrict opening of Substance Painter files from untrusted or unknown sources
• Implement application allowlisting to control which file types can be opened in creative software
• Educate users on the risks of opening files from untrusted sources

Patch Information

Adobe has released a security update addressing this vulnerability. Organizations should review the Adobe Security Advisory APSB26-25 for specific patch information and download instructions. Ensure all instances of Substance 3D Painter are updated to a version newer than 11.1.2.

Workarounds

• If immediate patching is not possible, restrict Substance 3D Painter from opening files originating outside the organization
• Implement network segmentation to isolate workstations running creative software from sensitive data repositories
• Use virtual machines or sandboxed environments when working with files from external sources
• Temporarily disable or restrict access to Substance 3D Painter until patches can be applied