CVE-2026-75749: Substance3D Painter RCE Vulnerability

CVE-2026-75749 Overview

CVE-2026-75749 is an out-of-bounds write vulnerability [CWE-787] in Adobe Substance3D Painter. Successful exploitation lets attackers execute arbitrary code in the context of the current user. The flaw requires local user interaction: a victim must open a crafted malicious file for the attack to succeed.

Adobe published this issue in security advisory APSB26-129. Substance3D Painter is a widely used 3D texturing application, making crafted asset files a plausible delivery vector for targeted campaigns against digital content creators and visual effects studios.

Critical Impact
Attackers can achieve arbitrary code execution with the privileges of the current user by convincing that user to open a malicious Substance3D Painter file.

Affected Products

Adobe Substance3D Painter (Windows and macOS builds referenced in advisory APSB26-129)
All versions prior to the fix listed in Adobe's advisory
Environments where users open untrusted 3D asset files

Discovery Timeline

2026-08-25 - CVE-2026-75749 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-75749

Vulnerability Analysis

The vulnerability is an out-of-bounds write in the file-parsing logic of Substance3D Painter. When the application processes a malformed asset file, it writes data past the bounds of an allocated buffer. This corrupts adjacent memory structures such as heap metadata, function pointers, or virtual method tables.

An attacker who controls the overwritten bytes can redirect execution flow. The result is arbitrary code execution inside the Painter process, running with the privileges of the current user. Because the attack vector is local and requires user interaction, exploitation typically arrives through social engineering, shared project files, or supply-chain distribution of tampered assets.

The issue is scored 7.8 on CVSS 3.1. The confidentiality, integrity, and availability impacts are all rated High because arbitrary code execution grants full control over resources accessible to the user.

Root Cause

The root cause is missing or insufficient bounds validation when parsing untrusted file structures. The parser trusts a length, offset, or index value embedded in the input file and uses it to compute a write destination without verifying the write stays within the allocated region. See the Adobe Security Advisory APSB26-129 for the affected components.

Attack Vector

Exploitation requires a local user to open a malicious file inside Substance3D Painter. Delivery typically uses email attachments, shared project archives, cloud storage links, or compromised asset marketplaces. Once the crafted file is opened, the corrupted parser executes attacker-controlled shellcode inside the Painter process.

No verified proof-of-concept code is publicly available for this issue. Refer to Adobe's advisory for technical remediation details.

Detection Methods for CVE-2026-75749

Indicators of Compromise

Unexpected child processes spawned by the Substance3D Painter executable, such as cmd.exe, powershell.exe, or shell interpreters on macOS
Substance3D Painter crashes or unusual exception logs immediately after opening a third-party asset file
Outbound network connections initiated by the Painter process to unknown hosts following file open events
Newly created executables or scripts in user-writable directories timestamped near a Painter session

Detection Strategies

Monitor process lineage where Substance3D Painter is the parent of interpreter or scripting binaries
Alert on file-write operations by the Painter process into autostart, scheduled task, or LaunchAgent locations
Correlate application crash telemetry with subsequent file executions in the same user session
Baseline network destinations reached by the Painter process and flag deviations

Monitoring Recommendations

Enable endpoint telemetry collection for process creation, module loads, and file writes originating from Substance3D Painter
Ingest Adobe application logs and OS crash reports into a central SIEM for correlation
Track distribution channels for shared .spp and related 3D asset files and flag files received from external senders

How to Mitigate CVE-2026-75749

Immediate Actions Required

Apply the Substance3D Painter update listed in Adobe advisory APSB26-129 to all endpoints running the application
Instruct users to open Substance3D Painter files only from trusted sources until patching is complete
Inventory hosts with Substance3D Painter installed and prioritize creative workstations for patch deployment
Review recent file-share activity for suspicious .spp or asset files delivered from external parties

Patch Information

Adobe released fixed versions in security bulletin APSB26-129. Administrators should consult the advisory for exact fixed version numbers and download links, then deploy through their standard software distribution mechanism.

Workarounds

Restrict Substance3D Painter to opening files from vetted internal storage locations only
Run Substance3D Painter under a standard user account with no administrative rights to limit blast radius
Use application allowlisting to block child process creation by the Painter executable
Quarantine 3D asset files received from external sources until scanned and validated

bash

# Example: block Substance3D Painter from spawning shell interpreters via WDAC or AppLocker policy
# Review Adobe advisory APSB26-129 for authoritative patch versions before deployment