CVE-2026-75769: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-75769 is a Heap-based Buffer Overflow vulnerability in Adobe Substance3D - Painter that could result in arbitrary code execution in the context of the current user. It affects all versions of Substance3D - Painter up to and including 12.1.2; version 12.1.3 is the patched release. The vulnerability was published on August 25, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Adobe Advisory).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), where a buffer allocated in the heap portion of memory can be overwritten due to insufficient bounds checking during file parsing operations. An attacker exploits this by crafting a malicious file that, when opened by a victim in Substance3D - Painter, triggers an out-of-bounds write to heap memory. The attack vector is local (AV:L) with low complexity, requiring no privileges but necessitating user interaction — specifically, the victim must open the malicious file. No public proof-of-concept or technical write-up detailing the specific file format or parsing routine involved has been identified (Github Advisory, Adobe Advisory).

Successful exploitation allows an unauthenticated local attacker to execute arbitrary code with the privileges of the user running Substance3D - Painter, resulting in high impact to confidentiality, integrity, and availability. An attacker could access sensitive data, modify files, or cause application crashes on the affected system. The scope is unchanged, meaning the impact is confined to the security context of the vulnerable application and the current user's session (Github Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit for CVE-2026-75769. The NVD SSVC assessment confirms exploitation is "none" and the vulnerability is not automatable, as it requires a victim to manually open a malicious file. The EPSS score is approximately 0.186% (8th percentile), indicating a low near-term probability of exploitation. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

Adobe has released Substance3D - Painter version 12.1.3 to address this vulnerability; users should update immediately via the Creative Cloud desktop application or Adobe's official download channels. As a precautionary measure, users should avoid opening Substance3D - Painter project files or assets received from untrusted or unknown sources. Organizations may also consider implementing file validation controls and user awareness training around social engineering attacks that deliver malicious files (Adobe Advisory).