CVE-2026-75768: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-75768 is an Untrusted Search Path vulnerability (CWE-426) in Adobe Substance3D - Painter that could result in arbitrary code execution in the context of the current user. All versions up to and including 12.1.2 are affected; version 12.1.3 resolves the issue. The vulnerability was published on August 25, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Adobe Advisory).

The vulnerability is classified as CWE-426 (Untrusted Search Path), meaning the application searches for critical resources — such as DLLs or executables — using a search path that can be influenced by an attacker-controlled environment or file. This maps to MITRE ATT&CK technique T1574.007 (Path Interception by PATH Environment Variable) and CAPEC-38 (Leveraging/Manipulating Configuration File Search Paths). Exploitation requires a local attack vector with low complexity and no privileges, but does require user interaction: the victim must open a specially crafted malicious file that triggers the unsafe path resolution (Github Advisory).

Successful exploitation grants an attacker arbitrary code execution with the full privileges of the user running Substance3D - Painter, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive user data, modify or destroy files, and potentially disrupt the application entirely. Because the scope is unchanged and the attack is local, lateral movement to other systems is not directly facilitated, but the compromised user account could be leveraged for further actions on the local machine (Github Advisory, Adobe Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment confirms exploitation is currently "none" and the attack is not automatable. The EPSS score is approximately 0.169%, placing it in the 6th percentile for exploitation likelihood within 30 days. A Nessus detection plugin (ID 341185) is available for scanning (Github Advisory).

1. Craft a malicious file: The attacker creates a specially crafted Substance3D Painter project file (or associated resource file) that, when opened, causes the application to search for a critical resource (e.g., a DLL or executable) in an attacker-controlled directory.
2. Plant a malicious binary: The attacker places a malicious DLL or executable with the expected name in a directory that appears earlier in the search path than the legitimate resource location (e.g., the same directory as the malicious file, or a writable directory in the PATH).
3. Social engineering: The attacker delivers the malicious file to the victim via email, file sharing, or other means, and convinces the victim to open it with Substance3D - Painter.
4. Trigger code execution: When the victim opens the file, Substance3D - Painter resolves the untrusted search path and loads the attacker's malicious binary, executing arbitrary code with the privileges of the current user (Github Advisory).

• File System: Unexpected DLL or executable files placed in directories alongside Substance3D Painter project files or in user-writable directories on the PATH; newly created or modified files in the Substance3D Painter installation or working directories.
• Process: Unusual child processes spawned by the Substance3D Painter process (e.g., cmd.exe, powershell.exe, curl, or other unexpected executables); DLL load events from non-standard or user-writable directories logged by process monitoring tools.
• Logs: Windows Event Logs (Event ID 4688 or Sysmon Event ID 1) showing unexpected process creation originating from the Substance3D Painter process; Sysmon Event ID 7 (Image Loaded) showing DLLs loaded from unusual paths.

Adobe has released Substance3D - Painter version 12.1.3 to address this vulnerability; all users running version 12.1.2 or earlier should update immediately via the Adobe Creative Cloud application or the Adobe download portal (Adobe Advisory). As a precautionary measure, users should avoid opening Substance3D Painter project files received from untrusted or unexpected sources. Organizations can also restrict write access to directories in the system PATH to reduce the risk of path interception attacks.

The vulnerability was noted in CISA's weekly vulnerability bulletin (SB26-243) and picked up by standard vulnerability tracking feeds including VulDB, CVEFeed, and AusCERT shortly after disclosure. No significant independent researcher commentary or notable media coverage beyond routine vulnerability aggregation has been observed for this CVE.