CVE-2026-75767: Substance3D Painter RCE Vulnerability

CVE-2026-75767 Overview

CVE-2026-75767 is a heap-based buffer overflow vulnerability in Adobe Substance3D Painter. Successful exploitation allows arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file crafted by an attacker.

The vulnerability is classified under [CWE-122] Heap-based Buffer Overflow. Adobe addressed the issue in security bulletin APSB26-129. The attack vector is local, and no authentication is required to exploit an affected system once the malicious file is opened.

Critical Impact
An attacker who convinces a user to open a crafted project or asset file can execute arbitrary code with the privileges of the Substance3D Painter user, enabling account takeover or lateral movement.

Affected Products

Adobe Substance3D Painter (versions prior to the APSB26-129 fix)
Windows installations of Substance3D Painter
macOS installations of Substance3D Painter

Discovery Timeline

2026-08-25 - CVE-2026-75767 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75767

Vulnerability Analysis

The flaw is a heap-based buffer overflow [CWE-122] in Adobe Substance3D Painter. Substance3D Painter processes complex 3D asset formats, including textures, meshes, and project archives. During parsing of an attacker-controlled file, the application writes beyond the allocated bounds of a heap buffer.

Because the write occurs on the heap, an attacker can corrupt adjacent objects, function pointers, or metadata structures. This corruption can be shaped to redirect control flow and achieve arbitrary code execution in the user's session. Exploitation results in full compromise of confidentiality, integrity, and availability of the user context.

Root Cause

The root cause is missing or insufficient bounds validation when the parser copies untrusted data from a supplied file into a fixed-size heap allocation. When a size field or embedded length is larger than the destination buffer, the copy operation writes past the end of the allocation. Adobe's advisory APSB26-129 describes the issue as a heap-based buffer overflow but does not publicly identify the specific file format or parsing routine.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious Substance3D asset or project file and delivers it through email, a shared workspace, a marketplace listing, or a compromised website. When the victim opens the file in Substance3D Painter, the vulnerable parser processes the attacker-controlled data and triggers the overflow.

Code executes with the privileges of the current user. In creative and enterprise environments where users often hold local administrator rights, this can be leveraged for persistence and credential theft. Refer to the Adobe Security Patch APSB26-129 for vendor technical guidance.

Detection Methods for CVE-2026-75767

Indicators of Compromise

Substance3D Painter (Adobe Substance 3D Painter.exe or Substance 3D Painter) spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters
Unexpected outbound network connections initiated by the Substance3D Painter process
Crash dumps or Windows Error Reporting entries referencing heap corruption in the Substance3D Painter process
Suspicious .spp, .sbsar, or texture files delivered through email attachments or file shares from untrusted senders

Detection Strategies

Monitor process lineage for Substance3D Painter and alert on any child process outside the expected set of helper binaries
Baseline the network behavior of the application and flag deviations, particularly connections to non-Adobe infrastructure
Hunt for file writes by the Painter process to autorun locations, scheduled task directories, or startup folders
Correlate file-open events for 3D asset extensions with subsequent process crashes or exploitation-related behavior

Monitoring Recommendations

Enable EDR telemetry for module loads, memory allocations, and process injection attempts originating from Substance3D Painter
Ingest application crash telemetry into the SIEM to identify heap corruption patterns across the fleet
Track software inventory to confirm that all Substance3D Painter installations report a version at or above the APSB26-129 fixed release

How to Mitigate CVE-2026-75767

Immediate Actions Required

Apply the update referenced in Adobe security bulletin APSB26-129 to every Substance3D Painter installation
Instruct users not to open Substance3D project or asset files received from untrusted or unverified sources
Inventory endpoints running Substance3D Painter and prioritize creative, design, and gaming studio workstations
Remove local administrator rights from Substance3D Painter users where operationally feasible to limit blast radius

Patch Information

Adobe released fixed versions of Substance3D Painter as documented in Adobe Security Patch APSB26-129. Administrators should consult the bulletin for the exact fixed version numbers for Windows and macOS, then deploy through the Adobe Creative Cloud desktop client or an enterprise software distribution platform.

Workarounds

Block delivery of Substance3D asset file types at the email gateway from external senders until patching is complete
Restrict opening of unsolicited 3D project files through user awareness training and endpoint file-type policies
Run Substance3D Painter under a standard user account rather than an administrative account to reduce impact if exploited

bash

# Configuration example: verify installed Substance3D Painter version on Windows
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Painter*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation