CVE-2026-21365: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-21365 is an out-of-bounds read vulnerability in Adobe Substance 3D Painter that can lead to memory disclosure. It affects Substance 3D Painter versions 11.1.2 and earlier, and was disclosed on March 10, 2026, with a patch released the same day. Exploitation requires user interaction — a victim must open a malicious file. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), occurring when Substance 3D Painter processes a specially crafted file without properly validating memory boundaries, resulting in reads beyond the allocated buffer. The attack vector is local, requiring no privileges but necessitating user interaction (opening a malicious file). An attacker would need to socially engineer a victim into opening a crafted project or asset file within the application. No public technical write-ups or proof-of-concept code have been identified (Adobe Advisory).

Successful exploitation results in memory disclosure, allowing an attacker to access sensitive information stored in the application's memory at the time the malicious file is opened. The impact is limited to confidentiality — there is no integrity or availability impact. The local attack vector and requirement for user interaction constrain the blast radius, but exposed memory could contain credentials, session tokens, or other sensitive data processed by the application (Adobe Advisory).

Adobe has released Substance 3D Painter version 11.1.3, which addresses this vulnerability. Users should update to version 11.1.3 or later as the primary remediation step. As an interim measure, organizations should educate users to avoid opening Substance 3D Painter project or asset files from untrusted or unknown sources, and consider restricting file type associations where operationally feasible (Adobe Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Adobe products patched in March 2026, including CVE-2026-21365, flagging potential for sensitive data exposure (CIS Advisory). General community reaction has been minimal given the medium severity rating and lack of active exploitation.