CVE-2026-75766: Substance3D Painter RCE Vulnerability

CVE-2026-75766 Overview

Adobe Substance3D Painter contains a heap-based buffer overflow vulnerability that enables arbitrary code execution in the context of the current user. The flaw is classified under [CWE-122] and requires user interaction to trigger. An attacker must convince a victim to open a crafted malicious file in Substance3D Painter. Successful exploitation yields code execution with the privileges of the user running the application.

Critical Impact
Attackers can execute arbitrary code on victim workstations by delivering a malicious project or asset file, compromising confidentiality, integrity, and availability of the affected system.

Affected Products

Adobe Substance3D Painter (see Adobe Security Advisory APSB26-129 for affected versions)

Discovery Timeline

2026-08-25 - CVE-2026-75766 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-75766

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in Adobe Substance3D Painter. Substance3D Painter parses complex 3D asset and project file formats containing textures, meshes, and material definitions. When the application processes a malformed file, it writes data beyond the bounds of a heap-allocated buffer.

This heap corruption can overwrite adjacent chunk metadata or object pointers. An attacker who controls the overflowed data can steer program execution toward attacker-supplied code. Because Substance3D Painter runs as a desktop application, code execution occurs with the privileges of the interactive user.

The attack vector is local and requires user interaction: a victim must open the malicious file. No prior authentication is required, and exploitation does not need network access to the target.

Root Cause

The root cause is missing or incorrect bounds validation when parsing untrusted file content into a heap buffer. Length or count fields inside the file are trusted without verification against the size of the destination allocation, allowing an oversized copy operation to corrupt the heap.

Attack Vector

An attacker crafts a malicious Substance3D project, texture, or asset file and delivers it through email, chat, a shared drive, or a compromised asset marketplace. When the victim opens the file in Substance3D Painter, the parser triggers the overflow. The attacker then achieves arbitrary code execution as the current user, enabling credential theft, lateral movement, or ransomware staging.

No public proof-of-concept exploit is currently listed for this issue. Refer to the Adobe Security Advisory APSB26-129 for vendor-supplied technical detail.

Detection Methods for CVE-2026-75766

Indicators of Compromise

Substance3D Painter process (Adobe Substance 3D Painter.exe) crashing or terminating unexpectedly shortly after opening a file from an untrusted source.
Unexpected child processes spawned by Substance3D Painter, such as command shells, scripting interpreters, or rundll32.exe.
Outbound network connections from the Substance3D Painter process to unknown or non-Adobe infrastructure.
Newly created executables, scripts, or scheduled tasks in user-writable directories immediately following the opening of a 3D asset file.

Detection Strategies

Alert on process lineage anomalies where Substance3D Painter is the parent of shells, LOLBins, or persistence utilities.
Correlate file-open telemetry for Substance3D project or asset files (arriving from email, browser downloads, or removable media) with subsequent suspicious process activity.
Deploy behavioral endpoint detection that flags heap corruption artifacts such as access violations followed by control-flow anomalies inside the Painter process.

Monitoring Recommendations

Enable command-line and module-load logging for Substance3D Painter and forward events to a centralized analytics platform.
Track installed versions of Substance3D Painter across the fleet and alert on hosts running unpatched builds.
Monitor for delivery of Substance3D file types (.spp, .sbs, .sbsar, texture and mesh formats) through email and web gateways.

How to Mitigate CVE-2026-75766

Immediate Actions Required

Apply the Adobe-provided update for Substance3D Painter as documented in Adobe Security Advisory APSB26-129.
Inventory all workstations running Substance3D Painter and prioritize patching for users who handle third-party assets or client-supplied files.
Instruct users to open Substance3D files only from trusted sources until patching is complete.

Patch Information

Adobe has published fixed versions in Adobe Security Advisory APSB26-129. Administrators should consult the advisory for exact version numbers and download the updated installers from the Adobe Creative Cloud desktop application or the Adobe website.

Workarounds

Restrict opening of Substance3D project and asset files to files originating from vetted internal repositories.
Run Substance3D Painter under a standard (non-administrative) user account to limit the impact of code execution.
Use application allowlisting and email gateway filtering to block or quarantine Substance3D file types received from external senders.
Enable operating-system exploit mitigations such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) for the Painter process.

bash

# Verify installed Substance3D Painter version on Windows
reg query "HKLM\SOFTWARE\Adobe\Adobe Substance 3D Painter" /s | findstr /i version

# Verify installed version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Substance 3D Painter.app"