CVE-2026-75770: Out-of-bounds Write (CWE-787) in Adobe Substance3D - Painter

Adobe Substance3D - Painter contains an out-of-bounds write vulnerability (CWE-787) that may lead to arbitrary code execution in the context of the current user. Successful exploitation depends on user interaction, requiring the victim to open a crafted malicious file. The CVSS 3.1 vector indicates local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No patch or official remediation level has been published yet.

If exploited, this vulnerability could allow an attacker to execute arbitrary code with the same privileges as the current user, potentially leading to full compromise of the affected system's user context. The requirement for user interaction limits the attack vector to scenarios where a user opens a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening files from untrusted sources to avoid triggering this vulnerability.