CVE-2026-75750: Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)
Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Users of Substance3D - Painter who open files from untrusted or unknown sources are exposed. Successful exploitation runs code in the context of the current user.
What must an attacker do to exploit the issue?
An attacker must provide a malicious file and convince a victim to open it in Substance3D - Painter. The vulnerability has local attack vector and requires user interaction; no privileges are required.
What can be done while a fix is not available or cannot be applied?
Do not open Substance3D - Painter files from untrusted sources. Treat unexpected files received through email, downloads, or shared locations as potentially malicious until they have been validated.