CVE-2026-34675: Adobe Substance 3D Painter RCE Vulnerability

CVE-2026-34675 Overview

CVE-2026-34675 is an out-of-bounds write vulnerability affecting Adobe Substance 3D Painter versions 12.0.2 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. The vulnerability is classified under CWE-787 and requires local access plus user interaction to exploit.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the user running Substance 3D Painter, enabling installation of malware, data theft, or lateral movement.

Affected Products

Adobe Substance 3D Painter version 12.0.2
Adobe Substance 3D Painter versions prior to 12.0.2
Windows and macOS installations of the affected product

Discovery Timeline

2026-05-12 - CVE-2026-34675 published to the National Vulnerability Database
2026-05-12 - Adobe published Security Advisory APSB26-55
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-34675

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition triggered during parsing of a crafted project or asset file. When Substance 3D Painter processes the malformed file, it writes data past the bounds of an allocated buffer. Attackers can leverage this memory corruption to overwrite adjacent structures, control execution flow, and achieve arbitrary code execution within the user's process context.

Because the attack vector is local and requires user interaction, exploitation typically depends on social engineering. An attacker delivers a malicious .spp, texture, or asset file through email, file sharing services, or compromised asset marketplaces. Opening the file inside the application triggers the vulnerable parser path.

The resulting code execution inherits the privileges of the current user. On workstations used by 3D artists, this often includes access to creative pipelines, source assets, and credentials cached by collaboration tools.

Root Cause

The root cause is improper bounds checking during file parsing, mapped to [CWE-787] Out-of-Bounds Write. The parser fails to validate the size of attacker-controlled input against the destination buffer before performing a write operation, corrupting memory in a controllable way.

Attack Vector

Exploitation requires a victim to open a malicious file in Substance 3D Painter. The attacker has no network reach into the target; delivery relies on phishing, supply chain poisoning of shared asset libraries, or trojanized project files distributed through artist communities. No additional privileges are required beyond those of the targeted user.

Adobe has not published technical details of the corrupted structure. Refer to Adobe Security Advisory APSB26-55 for vendor guidance.

Detection Methods for CVE-2026-34675

Indicators of Compromise

Unexpected child processes spawned from Substance 3D Painter.exe or the macOS equivalent, such as cmd.exe, powershell.exe, or shell interpreters
Crashes or abnormal terminations of Substance 3D Painter immediately after opening third-party project files
Outbound network connections from the Painter process to non-Adobe domains following file open events
Creation of executables, scripts, or scheduled tasks by the Painter process in user-writable directories

Detection Strategies

Monitor endpoint telemetry for process lineage anomalies where Substance 3D Painter spawns command interpreters or LOLBins
Apply behavioral analytics that flag memory corruption patterns such as access violations followed by suspicious child processes
Inspect file metadata on incoming .spp and texture archives for anomalous size fields or malformed headers prior to user access

Monitoring Recommendations

Centralize endpoint process and file telemetry from creative workstations into a SIEM or data lake for correlation
Alert on Substance 3D Painter version strings reporting 12.0.2 or earlier across the asset inventory
Track user-reported application crashes tied to files received from external sources as potential exploitation attempts

How to Mitigate CVE-2026-34675

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to the fixed version identified in Adobe Security Advisory APSB26-55
Inventory all creative workstations running Substance 3D Painter and prioritize patching version 12.0.2 and earlier
Instruct users to refuse opening project files from untrusted or unverified sources until patches are applied

Patch Information

Adobe released a patch addressing CVE-2026-34675. Apply the updated version referenced in Adobe Security Advisory APSB26-55. Validate the installed version after deployment to confirm remediation.

Workarounds

Restrict execution of Substance 3D Painter to standard user accounts to limit blast radius of successful exploitation
Use application allowlisting to block Substance 3D Painter from spawning command interpreters or scripting engines
Scan incoming asset bundles in a sandboxed environment before distributing them to artist workstations
Disable file association auto-open behavior for .spp files originating from email or messaging clients

bash

# Verify installed Substance 3D Painter version on Windows
reg query "HKLM\SOFTWARE\Adobe\Substance 3D Painter" /v Version

# Verify installed version on macOS
defaults read "/Applications/Adobe Substance 3D Painter.app/Contents/Info.plist" CFBundleShortVersionString