CVE-2026-75768 in Substance 3D Painter
Summary
by MITRE • 08/25/2026
Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The identified vulnerability within Substance 3D Painter represents an Untrusted Search Path flaw, technically classified under CWE-427. This category of security weakness occurs when software constructs a path to access external resources without properly validating the directory structure or ensuring that only trusted locations are searched for required files. In this specific instance, the application likely relies on dynamic linking or file loading mechanisms where it searches for necessary libraries or configuration files in directories that can be manipulated by local users. If an attacker gains control over a directory listed in the search path before the legitimate system paths, they can place maliciously crafted files with names matching those expected by Substance 3D Painter. When the application launches and attempts to load these resources, it inadvertently loads the attacker-controlled file instead of the genuine one, leading to arbitrary code execution within the context of the currently logged-in user.
From an operational perspective, this vulnerability poses a significant risk because exploitation requires user interaction, specifically the act of opening a malicious file or navigating to a compromised directory structure where the application resides. This aligns with ATT&CK technique T1204, User Execution, as the victim must actively engage with the environment for the attack to succeed. However, once triggered, the consequences are severe. Since the code executes in the context of the current user, an attacker could potentially escalate privileges if that user has administrative rights or access sensitive data stored locally on the machine. The ability to execute arbitrary code means that attackers can install malware, exfiltrate personal information, create backdoors for persistent access, or use the compromised system as a pivot point for further network attacks.
The technical mechanism behind this flaw typically involves improper handling of relative paths or environment variables during the initialization phase of the application. For example, if Substance 3D Painter looks for a specific DLL in the current working directory before checking standard system directories like System32, an attacker can place a malicious DLL with that name in the same folder as the executable or any project file opened by the user. The operating system will resolve this path first due to its search order precedence rules, leading to the execution of untrusted code. This is particularly dangerous because it bypasses many traditional perimeter defenses since the attack originates from within the trusted boundary of the local machine and relies on social engineering tactics such as phishing or malicious file sharing rather than remote network exploitation.
To mitigate this vulnerability, users should ensure that Substance 3D Painter is updated to the latest version provided by Adobe, which likely includes patches addressing path validation logic. Administrators can also enforce strict security policies through Group Policy Objects (GPO) on Windows systems to disable DLL search order hijacking or to restrict application execution paths. Additionally, implementing Application Control solutions such as Microsoft AppLocker or Windows Defender Application Control can prevent unauthorized binaries from executing in critical directories. Users should be educated to avoid opening files from untrusted sources and to maintain strict access controls over shared network drives or local folders where the software is installed. Regular security audits of file permissions on application directories are also recommended to ensure that only authorized users have write access, thereby reducing the attack surface for path manipulation attacks.