CVE-2026-34675: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-34675 is an out-of-bounds write vulnerability in Adobe Substance 3D Painter that could allow arbitrary code execution in the context of the current user. It affects Substance 3D Painter versions 12.0.2 and earlier, and was disclosed and patched on May 12, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Adobe Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), meaning the application writes data beyond the bounds of an allocated memory buffer when processing certain file types. Exploitation requires a victim to open a specially crafted malicious file, making this a local, user-interaction-dependent attack vector with low attack complexity and no privileges required. No public technical write-ups or proof-of-concept code have been identified at this time (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, resulting in high confidentiality, integrity, and availability impact on the affected system. Since exploitation is limited to the current user's context, privilege escalation is not inherent, but the attacker could access sensitive project files, install malware, or pivot further depending on the user's permissions. The attack is confined to the local machine where the malicious file is opened (Adobe Advisory).

1. Craft a malicious file: An attacker creates a specially crafted file (e.g., a project or asset file compatible with Substance 3D Painter) that contains malformed data designed to trigger an out-of-bounds write when parsed by the application.
2. Deliver the file: The attacker distributes the malicious file via phishing email, a compromised file-sharing platform, or a malicious download site targeting Substance 3D Painter users.
3. Victim opens the file: The victim opens the malicious file in an unpatched version of Substance 3D Painter (≤ 12.0.2), triggering the out-of-bounds write vulnerability during file parsing.
4. Achieve code execution: The memory corruption caused by the out-of-bounds write is leveraged to redirect execution flow, resulting in arbitrary code execution with the privileges of the current user (Adobe Advisory).

• Process: Unexpected child processes spawned by the Substance 3D Painter process (e.g., cmd.exe, powershell.exe, bash, curl, or other shells/utilities).
• File System: Newly created or modified files in user-writable directories (e.g., %APPDATA%, %TEMP%) shortly after opening a Substance 3D Painter file; unexpected executables or scripts dropped in the application directory.
• Network: Unusual outbound network connections originating from the Substance 3D Painter process to unknown external IP addresses or domains.
• Logs: Application crash logs or Windows Event Logs indicating memory access violations or abnormal termination of Substance 3D Painter around the time a file was opened.

Adobe has released Substance 3D Painter version 12.0.3 to address this vulnerability; users should update immediately via the Creative Cloud desktop application or Adobe's official download channels. As an interim measure, users should avoid opening Substance 3D Painter files from untrusted or unknown sources, and administrators should consider restricting user permissions to limit the potential impact of code execution. No configuration-based workaround is available that fully mitigates the vulnerability without patching (Adobe Advisory).

The CIS (Center for Internet Security) issued an advisory noting that multiple Adobe vulnerabilities disclosed in May 2026, including this one, could allow for arbitrary code execution (CIS Advisory). No notable independent researcher commentary or significant social media discussion has been identified for this specific CVE.