CVE-2026-21305: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-21305 is an out-of-bounds write vulnerability in Adobe Substance 3D Painter that can result in arbitrary code execution in the context of the current user. It affects Substance3D - Painter versions 11.0.3 and earlier, with the fix available in version 11.1.2 and later. The vulnerability was disclosed on January 13, 2026, by Adobe Systems Incorporated, with NVD publication on the same date. It carries a CVSS v3.1 base score of 7.8 (High), assigned by Adobe (Adobe Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), meaning the application writes data beyond the bounds of an allocated memory buffer when processing certain file types. Exploitation requires a local attack vector with no privileges required, but does require user interaction — specifically, a victim must open a specially crafted malicious file. The low attack complexity suggests that once a malicious file is crafted, triggering the vulnerability is straightforward. No public technical write-ups or proof-of-concept code have been identified at this time (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Substance3D Painter, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could potentially read sensitive files, modify data, or cause application crashes. Since the attack runs in the context of the current user, the scope is limited to that user's permissions, though it could serve as a foothold for further lateral movement if the user has elevated privileges.

1. Craft a malicious file: An attacker creates a specially crafted file (e.g., a project or asset file compatible with Substance3D Painter) that triggers an out-of-bounds write when parsed by the application.
2. Deliver the file: The attacker distributes the malicious file via phishing email, a compromised file-sharing platform, or a malicious download site targeting Substance3D Painter users.
3. Victim opens the file: The victim, running Substance3D Painter version 11.0.3 or earlier, opens the malicious file through the application's normal file-open workflow.
4. Trigger out-of-bounds write: The application writes data beyond the bounds of an allocated buffer during file parsing, corrupting adjacent memory.
5. Achieve code execution: The memory corruption is leveraged to redirect execution flow, resulting in arbitrary code execution in the context of the current user, potentially enabling payload delivery, data exfiltration, or persistence (Adobe Advisory).

• Process: Unexpected child processes spawned by the Substance3D Painter process (e.g., cmd.exe, powershell.exe, bash, curl, or other shells/utilities).
• File System: Unusual files written to the user's temp directory or application data folders shortly after opening a Substance3D Painter file; unexpected executables or scripts created in user-writable directories.
• Network: Outbound network connections initiated by the Substance3D Painter process to unknown or suspicious external IP addresses or domains.
• Logs: Application crash logs or Windows Event Logs indicating memory access violations or abnormal termination of the Substance3D Painter process; security logs showing new process creation from the Painter executable.

Adobe has released a patch in Substance3D Painter version 11.1.2, which addresses this vulnerability. Users should upgrade to version 11.1.2 or later immediately. As interim mitigations, organizations should restrict access to Substance3D Painter where not required, implement user awareness training to discourage opening files from untrusted sources, and monitor for suspicious process execution originating from the Painter application (Adobe Advisory).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Adobe products, including this one, could allow for arbitrary code execution (CIS Advisory). CISA included this vulnerability in its weekly vulnerability bulletin for the week of January 12, 2026. Community and media coverage has been limited, consistent with the low EPSS score and absence of active exploitation.