CVE-2026-75750: Substance3D Painter RCE Vulnerability

CVE-2026-75750 Overview

CVE-2026-75750 is a heap-based buffer overflow vulnerability in Adobe Substance3D Painter. Successful exploitation allows an attacker to execute arbitrary code in the context of the current user. The flaw is classified under [CWE-122] Heap-based Buffer Overflow and requires user interaction. A victim must open a malicious file crafted by the attacker for the vulnerability to trigger.

Adobe published the corresponding security advisory as APSB26-129. The vulnerability was added to the National Vulnerability Database (NVD) on August 25, 2026.

Critical Impact
An attacker who convinces a user to open a malicious project or asset file can execute arbitrary code with the privileges of the Substance3D Painter user, leading to full compromise of user data and workstation state.

Affected Products

Adobe Substance3D Painter (see Adobe advisory APSB26-129 for affected version ranges)
Windows and macOS installations of Substance3D Painter
Environments where users open third-party or untrusted Substance3D project files

Discovery Timeline

2026-08-25 - CVE-2026-75750 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75750

Vulnerability Analysis

Substance3D Painter parses complex 3D asset and project file formats, including textures, meshes, and material definitions. The vulnerability occurs when the application processes malformed input that causes a write beyond the boundaries of a heap-allocated buffer. This corruption enables an attacker to overwrite adjacent heap metadata or object pointers.

Because the attack vector is local and requires user interaction, exploitation depends on social engineering. Attackers typically deliver crafted files through email attachments, shared asset libraries, or compromised marketplaces used by 3D artists. Once opened, the malicious file triggers memory corruption during parsing and can pivot into arbitrary code execution under the current user context.

The process runs with the user's privileges, so successful exploitation gives the attacker access to any files, credentials, and network resources available to that account. On workstations used by design and creative teams, this often includes access to intellectual property and shared production storage.

Root Cause

The root cause is improper bounds checking during the parsing of untrusted file content. The application allocates a heap buffer sized against attacker-controlled fields but writes data without validating that the destination has sufficient capacity, corrupting adjacent heap structures.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a malicious Substance3D project or asset file and delivers it to a target user. When the user opens the file in Substance3D Painter, the parser triggers the heap overflow. See the Adobe Security Advisory APSB26-129 for vendor technical details.

No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism is described in prose because no realCodeExamples were provided in the source data.

Detection Methods for CVE-2026-75750

Indicators of Compromise

Unexpected child processes spawned by Substance3D Painter.exe such as command interpreters, PowerShell, or scripting hosts
Substance3D Painter crashes correlated with the opening of externally sourced project files (.spp, .sbsar, texture archives)
Outbound network connections initiated by the Substance3D Painter process to previously unseen destinations
New persistence artifacts (scheduled tasks, run keys, launch agents) created shortly after a user opens a suspicious asset file

Detection Strategies

Hunt for process ancestry anomalies where Substance3D Painter is the parent of interactive shells or living-off-the-land binaries
Alert on file writes by Substance3D Painter to autorun locations, startup folders, or user profile script directories
Correlate application crash telemetry (Windows Error Reporting, macOS crash logs) with file-open events referencing untrusted paths
Monitor email and collaboration platforms for inbound Substance3D asset files from unverified senders

Monitoring Recommendations

Enable command-line and process telemetry on all workstations running Adobe Creative Cloud and Substance3D applications
Forward endpoint telemetry to a centralized data lake for cross-user correlation of file-open and crash events
Track version inventory of Substance3D Painter installations to identify unpatched hosts
Baseline normal network egress for the Painter process and alert on deviations

How to Mitigate CVE-2026-75750

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-129 to all Substance3D Painter installations
Instruct users to open only Substance3D project and asset files from trusted internal sources or verified vendors
Block or quarantine inbound Substance3D file types at email gateways when senders are external and unverified
Verify workstation inventories to confirm no vulnerable Substance3D Painter builds remain in production

Patch Information

Adobe released a patched version of Substance3D Painter as documented in advisory APSB26-129. Refer to the Adobe Security Advisory APSB26-129 for the fixed version numbers, platform-specific download links, and installation guidance. Deploy the update through Adobe Creative Cloud desktop or your standard enterprise software distribution tooling.

Workarounds

Restrict Substance3D Painter usage to standard (non-administrative) user accounts to limit the blast radius of exploitation
Store production assets on controlled shares and prohibit opening files sourced from public marketplaces or unknown collaborators until patched
Apply application allow-listing rules that prevent Substance3D Painter from launching child processes such as shells or script interpreters
Enable operating system exploit mitigations (ASLR, DEP, CET where available) on hosts running Substance3D Painter

bash

# Example: Windows inventory query to identify Substance3D Painter versions
Get-CimInstance -ClassName Win32_Product | \
  Where-Object { $_.Name -like "*Substance 3D Painter*" } | \
  Select-Object Name, Version, InstallDate