CVE-2026-34676 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D - Painter versions 12.0.2 and earlier. This vulnerability allows an attacker to execute arbitrary code in the context of the current user if the user opens a crafted malicious file. The attack vector requires local user interaction (AV:L/UI:R) and has low attack complexity (AC:L) with no privileges required (PR:N). The vulnerability impacts confidentiality, integrity, and availability (C:H/I:H/A:H). As of the published date, no official patch or remediation level has been announced by Adobe.

Successful exploitation could result in arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. The attack requires the victim to open a malicious file, so social engineering or tricking the user is necessary. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening untrusted or suspicious files with Substance3D - Painter. Monitor Adobe's security advisories for updates on patches or mitigations.