CVE-2026-75752: Substance3D Painter Information Disclosure

CVE-2026-75752 Overview

CVE-2026-75752 is an out-of-bounds read vulnerability in Adobe Substance3D - Painter that can disclose sensitive memory contents to an attacker. The flaw is classified under [CWE-125] (Out-of-bounds Read). Exploitation requires user interaction: a victim must open a malicious file crafted by the attacker. Successful exploitation exposes process memory that may include pointers, file contents, or other confidential data useful for chaining further attacks.

Critical Impact
An attacker who convinces a user to open a malicious project or asset file can read memory outside the intended bounds and disclose sensitive information from the Substance3D - Painter process.

Affected Products

Adobe Substance3D - Painter (see Adobe advisory APSB26-129 for affected versions)

Discovery Timeline

2026-08-25 - CVE-2026-75752 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75752

Vulnerability Analysis

The issue is an out-of-bounds read in Substance3D - Painter's file parsing logic. When the application processes a specially crafted input file, it reads beyond the bounds of an allocated buffer. The out-of-bounds bytes are then reachable through the application's runtime state and can be surfaced to an attacker who controls the input.

The vulnerability does not grant code execution or write access on its own. The impact is limited to confidentiality: leaked memory can contain pointers useful for bypassing Address Space Layout Randomization (ASLR), or fragments of other files loaded in the same process. Attackers frequently pair information-disclosure primitives with a second memory-corruption bug to achieve reliable code execution.

Exploitation is local and requires user interaction. The attack surface is the file open path, so delivery typically relies on phishing, malicious asset sharing, or supply-chain compromise of 3D content pipelines.

Root Cause

The root cause is missing or incorrect bounds validation when parsing structured data inside a Substance3D - Painter file format. A length or offset field derived from attacker-controlled input drives a read past the end of the allocated buffer. Adobe's advisory APSB26-129 addresses the defect in updated builds.

Attack Vector

An attacker crafts a malicious Substance3D - Painter project or asset file and delivers it to a target. When the victim opens the file in Substance3D - Painter, the parser dereferences an attacker-influenced offset and reads adjacent memory. The disclosed data is then observable through application behavior or exfiltrated via a subsequent attacker-controlled operation.

No verified public proof-of-concept is available for CVE-2026-75752. Technical details are limited to what is documented in the Adobe Security Advisory APSB26-129.

Detection Methods for CVE-2026-75752

Indicators of Compromise

Substance3D - Painter processes opening files from unusual locations such as email attachment directories, browser downloads, or removable media.
Unexpected child processes or network connections initiated by Substance3D - Painter shortly after a file open event.
Application crashes or memory-access anomalies logged when opening third-party project files.

Detection Strategies

Monitor endpoint telemetry for Substance3D - Painter file open operations targeting files received from untrusted sources.
Correlate file-based delivery (email, chat, download) with subsequent execution of the Substance3D - Painter binary within a short time window.
Hunt for anomalous memory read patterns and crash reports generated by the Substance3D - Painter process.

Monitoring Recommendations

Ingest endpoint process and file telemetry into a centralized data lake for retrospective hunting against file-open behaviors.
Alert on Substance3D - Painter installations that have not received the update referenced in Adobe advisory APSB26-129.
Track user reports of unexpected crashes when opening externally sourced 3D assets.

How to Mitigate CVE-2026-75752

Immediate Actions Required

Apply the Substance3D - Painter security update referenced in Adobe Security Advisory APSB26-129 to all affected workstations.
Inventory endpoints running Substance3D - Painter and prioritize patch deployment for users who routinely process externally sourced 3D content.
Instruct users to open Substance3D - Painter files only from trusted sources until patching is complete.

Patch Information

Adobe published fixed versions of Substance3D - Painter in advisory APSB26-129. Refer to the vendor bulletin for exact build numbers and download locations, and validate deployment through software inventory tooling.

Workarounds

Restrict Substance3D - Painter to opening files from vetted internal repositories until the patched build is installed.
Use application allowlisting and file quarantine policies to block Substance3D - Painter file types received from external email and web sources.
Run Substance3D - Painter under a standard user account without elevated privileges to reduce downstream impact of memory disclosure.

bash

# Example: audit installed Substance3D - Painter version on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Painter*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation