CVE-2026-75768: Adobe Substance3D Painter RCE Vulnerability

CVE-2026-75768 Overview

CVE-2026-75768 is an untrusted search path vulnerability [CWE-426] in Adobe Substance3D Painter. An attacker can achieve arbitrary code execution in the context of the current user by exploiting how the application resolves paths for external resources such as dynamic libraries. Exploitation requires user interaction: the victim must open a malicious file. The issue is tracked in Adobe Security Bulletin APSB26-129.

Critical Impact
Successful exploitation grants arbitrary code execution under the current user's privileges, enabling full compromise of files, credentials, and data accessible to that account.

Affected Products

Adobe Substance3D Painter (see Adobe Security Advisory APSB26-129 for exact version ranges)

Discovery Timeline

2026-08-25 - CVE-2026-75768 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-75768

Vulnerability Analysis

Substance3D Painter loads external resources using an untrusted search path. When the application launches or opens a project file, it searches predictable directory locations for dependent libraries or plugins without validating their origin. An attacker who can place a malicious file alongside a project asset can cause the application to load attacker-controlled code.

The vulnerability is local and requires user interaction. The victim must open a specially crafted file, typically a project package or asset bundle, in a directory the attacker controls. Once loaded, the attacker's payload runs with the same privileges as the user running Substance3D Painter.

Root Cause

The root cause is improper control of the resource resolution path, classified under [CWE-426] Untrusted Search Path. The application resolves library or plugin names against directories that untrusted actors can influence, such as the current working directory or a folder embedded within a downloaded project archive. Trusted system paths are not enforced as the exclusive search location.

Attack Vector

The attack vector is local with required user interaction. A typical exploitation chain involves the attacker packaging a malicious dynamic library or plugin with a Substance3D project file. The victim downloads the archive, extracts it, and opens the project. Substance3D Painter then loads the attacker's binary from the extraction directory instead of the legitimate location, executing arbitrary code.

No verified public exploit code has been released. See the Adobe Security Advisory APSB26-129 for vendor technical details.

Detection Methods for CVE-2026-75768

Indicators of Compromise

Unexpected dynamic-link libraries (.dll, .dylib, .so) or plugin files residing next to Substance3D project files in user download or temporary directories.
Substance3D Painter processes spawning child processes such as cmd.exe, powershell.exe, or shell interpreters that are inconsistent with normal 3D authoring workflows.
Outbound network connections initiated by the Substance3D Painter process to unfamiliar hosts shortly after a project file is opened.

Detection Strategies

Monitor process-creation telemetry for Substance3D Painter loading modules from user-writable directories rather than the application's installation path.
Alert on file-write events that place executable content (DLLs, shared libraries, scripts) into directories containing recently downloaded archives.
Correlate archive-extraction events with subsequent application launches to identify potential drive-by staging of malicious payloads.

Monitoring Recommendations

Enable module-load auditing on endpoints that run Substance3D Painter and forward events to a centralized analytics platform.
Track user opens of project files sourced from email attachments, browsers, or removable media as elevated-risk events.
Review endpoint detection alerts for anomalous library loads by graphics or creative-suite applications.

How to Mitigate CVE-2026-75768

Immediate Actions Required

Apply the patched Substance3D Painter version referenced in Adobe Security Advisory APSB26-129 on all affected workstations.
Instruct users to open Substance3D project files only from trusted sources and to avoid opening projects directly from download or extraction folders.
Inventory endpoints running Substance3D Painter and prioritize patching for artists, contractors, and any accounts with elevated data access.

Patch Information

Adobe has released fixed versions of Substance3D Painter that address CVE-2026-75768. Refer to Adobe Security Advisory APSB26-129 for the specific patched version numbers, download locations, and platform coverage.

Workarounds

Move downloaded project archives into a dedicated, isolated directory that does not contain third-party binaries before opening them.
Enforce application allowlisting to prevent Substance3D Painter from loading unsigned modules outside its installation directory.
Run Substance3D Painter under least-privilege user accounts to limit the impact of any successful exploitation.