CVE-2026-75770: Substance3D Painter RCE Vulnerability

CVE-2026-75770 Overview

Adobe Substance3D Painter contains an out-of-bounds write vulnerability [CWE-787] that enables arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file crafted by the attacker. The flaw affects file parsing routines within the 3D texturing application and can be triggered without prior authentication to the target system.

Adobe disclosed the issue in security bulletin APSB26-129. The vulnerability carries a local attack vector with high impact to confidentiality, integrity, and availability.

Critical Impact
A crafted project or asset file opened in Substance3D Painter can corrupt process memory and execute attacker-controlled code with the privileges of the logged-in user.

Affected Products

Adobe Substance3D - Painter (see APSB26-129 for affected version ranges)
Windows and macOS installations of Substance3D Painter
Environments processing untrusted 3D asset or project files

Discovery Timeline

2026-08-25 - CVE-2026-75770 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-75770

Vulnerability Analysis

The vulnerability is an out-of-bounds write in Adobe Substance3D Painter's file processing logic. When the application parses a maliciously constructed file, it writes data past the bounds of an allocated buffer. This memory corruption can overwrite adjacent structures, function pointers, or heap metadata used later by the process.

An attacker who controls the layout of the overwritten memory can redirect execution to injected shellcode or existing gadgets. Because Substance3D Painter runs with the privileges of the interactive user, successful exploitation grants code execution at that privilege level. Artists and designers frequently receive project files from external collaborators, which increases the practical attack surface.

Root Cause

The root cause is missing or incorrect bounds validation during parsing of a specific file format handled by Substance3D Painter. Adobe has not published field-level details in the public advisory. The CWE-787 classification indicates that untrusted input drives a write operation whose destination offset or length is not properly constrained.

Attack Vector

Exploitation requires local access in the sense that the victim must open the malicious file on a system where Substance3D Painter is installed. Delivery vectors include email attachments, shared asset libraries, marketplaces for 3D content, and compromised collaboration platforms. No network exposure of the application itself is required. Refer to the Adobe Security Advisory APSB26-129 for vendor guidance and version details.

Detection Methods for CVE-2026-75770

Indicators of Compromise

Unexpected child processes spawned by Substance 3D Painter.exe such as cmd.exe, powershell.exe, or rundll32.exe
Substance3D Painter process crashes with access violations shortly after opening a project or asset file
Outbound network connections initiated by the Substance3D Painter process to unfamiliar hosts
Newly created executables or scripts in user-writable paths following the opening of an untrusted 3D file

Detection Strategies

Hunt for process lineage in which Substance3D Painter parents interpreters, shells, or LOLBins used for follow-on execution
Correlate file-open telemetry for Substance3D formats with subsequent module loads or memory allocations flagged as suspicious
Alert on Substance3D Painter loading unsigned dynamic libraries from user-writable directories

Monitoring Recommendations

Collect endpoint process, module, and file telemetry from workstations running Substance3D Painter into a centralized data lake
Monitor for repeated Substance3D Painter crashes across the fleet, which can indicate exploit development or unreliable payloads
Track ingress of .spp, .sbsar, and related Substance file types from email and web sources for retrospective review

How to Mitigate CVE-2026-75770

Immediate Actions Required

Apply the updates identified in Adobe Security Advisory APSB26-129 to all Substance3D Painter installations
Inventory endpoints with Substance3D Painter installed and prioritize patching for users who handle external 3D assets
Instruct users to open only Substance3D project and asset files from trusted sources until patching completes

Patch Information

Adobe released fixed versions of Substance3D Painter in bulletin APSB26-129. Administrators should consult the advisory for the exact patched version numbers and download links. Deploy the update through Creative Cloud or enterprise software distribution channels.

Workarounds

Restrict opening of Substance3D files to a segregated workstation or virtual machine when patching cannot be performed immediately
Remove or disable Substance3D Painter on systems that do not require it
Apply application allowlisting to prevent Substance3D Painter from launching child processes such as shells and script interpreters

bash

# Example: block common LOLBin child processes of Substance 3D Painter via AppLocker or WDAC policy
# Pseudocode policy rule
Deny ParentProcess: "Substance 3D Painter.exe"
     ChildProcess: ["cmd.exe","powershell.exe","wscript.exe","cscript.exe","rundll32.exe"]