{"id":"CVE-2026-48379","kind":"vulnerability","aliases":["CVE-2026-48379"],"related":[],"title":"Substance3D Painter: stack buffer overflow lets a malicious file run code","description":"Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Substance3D Painter has a stack-based buffer overflow that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Substance 3D Painter","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","desktop","macos","other","substance3d-painter","user-interaction","windows"],"not_affected_if":["no-untrusted-files"],"how_to_check":"In Painter, Help > About shows the installed version. Compare it to the affected range in Adobe's bulletin for this CVE, which has not been published yet (unknown). Until then, treat anything at 12.1.3 or earlier as possibly affected.","fix":"unknown: no Adobe bulletin for CVE-2026-48379 found yet. Update Painter via the Creative Cloud desktop app to the newest version once Adobe publishes it. Until then avoid opening untrusted .spp or other asset files.","status":"open","published_at":"2026-10-27T17:17:00+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:30+00:00","updated_at":"2026-10-27T17:39:40+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T17:34:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Substance3D Painter: stack buffer overflow lets a malicious file run code","impact":"high","summary":"Substance3D Painter has a stack-based buffer overflow that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.","category":"other","nicknames":[],"who_cares":["substance3d-painter","desktop","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Arbitrary code runs as the current user after opening a file","analyst_note":"Find the affected Substance3D Painter versions and the vendor patch from the NVD entry and Adobe's security bulletin.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-files"],"who_is_affected":"Teams whose designers or artists open third-party or untrusted files in Substance3D Painter on their workstations. Systems that never open external files in Painter are less exposed, but the sources do not list affected versions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000526,"input_tokens":3302,"output_tokens":392,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Substance3D Painter versions and the vendor patch from the NVD entry and Adobe's security bulletin.","search":"'-2026':13A,16A '-48379':14A,17A '3d':19A 'adob':21B 'affect':66C 'arbitrari':54B,79C 'attack':52B 'base':38B,71C 'buffer':4A,39B,72C 'code':11A,55B,80C 'context':84C 'could':76C 'craft':48B 'current':61B,87C 'cve':12A,15A 'desktop':22B 'execut':81C 'exploit':89C 'file':9A,49B,104C 'interact':30B,95C 'issu':92C 'let':6A 'maco':23B 'malici':8A,103C 'must':100C 'open':46B,101C 'overflow':5A,40B,73C 'painter':2A,20A,27B,33B,64C 'privileg':58B 'requir':93C 'result':77C 'run':10A,53B 'stack':3A,37B,70C 'stack-bas':36B,69C 'substance':18A 'substance3d':1A,26B,32B,63C 'substance3d-painter':25B 'success':51B 'trigger':44B 'user':29B,62B,88C,94C 'user-interact':28B 'victim':99C 'vulner':74C 'window':31B","nicknames":[],"mitigations":[],"who_affected":"Teams whose designers or artists open third-party or untrusted files in Substance3D Painter on their workstations. Systems that never open external files in Painter are less exposed, but the sources do not list affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48379","severity":null,"published_at":"2026-10-27T17:17:00+00:00","modified_at":"2026-10-27T17:17:00+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-48379:903","url":null,"severity":null,"published_at":"2026-10-27T17:39:40+00:00","modified_at":"2026-10-27T17:39:40+00:00","first_seen_at":"2026-10-27T17:39:40+00:00","fetched_at":"2026-10-27T17:39:40+00:00","note":"Published today by Adobe PSIRT (CWE-121, CVSS 7.8, user must open a malicious file). No Adobe bulletin for this CVE found yet: Painter bulletin list shows latest APSB26-129 (Aug 25, fixed 12.1.3) which does not list it; Oct 13 batch had no Painter bulletin in the results. Versions unknown; recheck helpx/adobe.com Painter bulletin page for a new APSB. No exploitation or PoC reported; no X/web discussion checked beyond search (none found)."}],"documents":[{"id":7203,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48379","title":"NVD: CVE-2026-48379 (Adobe PSIRT CNA, CWE-121, CVSS 7.8)","kind":"advisory","source":"analyst","text":"Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file. CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, scored by psirt@adobe.com. No affected/fixed versions listed.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}