---
id: "CVE-2026-48379"
kind: "vulnerability"
aliases: ["CVE-2026-48379"]
title: "Substance3D Painter: stack buffer overflow lets a malicious file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Substance 3D Painter", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe", "desktop", "macos", "other", "substance3d-painter", "user-interaction", "windows"]
not_affected_if: ["no-untrusted-files"]
published_at: "2026-10-27T17:17:00+00:00"
first_seen_at: "2026-10-27T17:32:46+00:00"
updated_at: "2026-10-27T17:39:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48379", "first_seen_at": "2026-10-27T17:32:46+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:39:40+00:00"}]
---

# Substance3D Painter: stack buffer overflow lets a malicious file run code

Substance3D Painter has a stack-based buffer overflow that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Substance 3D Painter affected unknown fixed ?

## How to check

In Painter, Help > About shows the installed version. Compare it to the affected range in Adobe's bulletin for this CVE, which has not been published yet (unknown). Until then, treat anything at 12.1.3 or earlier as possibly affected.

## Fix

unknown: no Adobe bulletin for CVE-2026-48379 found yet. Update Painter via the Creative Cloud desktop app to the newest version once Adobe publishes it. Until then avoid opening untrusted .spp or other asset files.

## Timeline

- 2026-10-27T17:32:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-48379
- 2026-10-27T17:39:40+00:00 analyst — Published today by Adobe PSIRT (CWE-121, CVSS 7.8, user must open a malicious file). No Adobe bulletin for this CVE found yet: Painter bulletin list shows latest APSB26-129 (Aug 25, fixed 12.1.3) which does not list it; Oct 13 batch had no Painter bulletin in the results. Versions unknown; recheck helpx/adobe.com Painter bulletin page for a new APSB. No exploitation or PoC reported; no X/web discussion checked beyond search (none found).

## Documents

- [advisory] NVD: CVE-2026-48379 (Adobe PSIRT CNA, CWE-121, CVSS 7.8) https://nvd.nist.gov/vuln/detail/CVE-2026-48379

## From the sources

Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_