CVE-2026-34676 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D - Painter up to version 12.0.2. This flaw could enable an attacker to execute arbitrary code in the context of the current user if the victim opens a crafted malicious file. The vulnerability requires user interaction and has a CVSS v3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability. No official fix or patch has been released as of the published date.

Successful exploitation could lead to arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. However, exploitation requires that the user opens a malicious file, limiting the attack vector to social engineering or targeted delivery. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources and consider restricting access to potentially malicious files. Monitor Adobe's official channels for updates and apply patches promptly once available.