{"id":"CVE-2026-48380","kind":"vulnerability","aliases":["CVE-2026-48380"],"related":[],"title":"Adobe Substance3D Painter: out-of-bounds read leaks memory via malicious file","description":"Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Substance3D Painter has an out-of-bounds read flaw that can expose sensitive memory contents. An attacker can exploit it by getting a victim to open a malicious file.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe","creative-workstations","other","substance3d-painter"],"not_affected_if":["no-untrusted-files"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:17:00+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:57+00:00","updated_at":"2026-10-27T17:34:57+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T17:34:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Substance3D Painter: out-of-bounds read leaks memory via malicious file","impact":"low","summary":"Substance3D Painter has an out-of-bounds read flaw that can expose sensitive memory contents. An attacker can exploit it by getting a victim to open a malicious file.","category":"other","nicknames":[],"who_cares":["substance3d-painter","adobe","creative-workstations"],"confidence":0.6,"needs_auth":"no","worst_case":"Sensitive process memory is disclosed to an attacker","analyst_note":"Find affected and fixed Substance3D Painter versions in the Adobe security bulletin for CVE-2026-48380.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-files"],"who_is_affected":"Teams that install Adobe Substance3D Painter on workstations and open untrusted project or asset files in it. Sources do not list affected or fixed versions. Teams that never open files from outside sources can treat this as low urgency.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000536,"input_tokens":3318,"output_tokens":409,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-48380':16A,19A 'adob':1A,20B 'affect':61C 'attack':45B,79C 'bound':7A,35B,67C 'content':43B 'could':71C,80C 'creativ':22B 'creative-workst':21B 'cve':14A,17A 'disclos':85C 'disclosur':74C 'exploit':47B,88C 'expos':40B 'file':13A,57B,103C 'flaw':37B 'get':50B 'inform':87C 'interact':94C 'issu':91C 'lead':72C 'leak':9A 'leverag':81C 'malici':12A,56B,102C 'memori':10A,42B,77C 'must':99C 'open':54B,100C 'out-of-bound':4A,32B,64C 'painter':3A,27B,29B,59C 'read':8A,36B,68C 'requir':92C 'sensit':41B,76C,86C 'substance3d':2A,26B,28B,58C 'substance3d-painter':25B 'user':93C 'via':11A 'victim':52B,98C 'vulner':69C,83C 'workstat':23B","nicknames":[],"mitigations":[],"who_affected":"Teams that install Adobe Substance3D Painter on workstations and open untrusted project or asset files in it. Sources do not list affected or fixed versions. Teams that never open files from outside sources can treat this as low urgency.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48380","severity":null,"published_at":"2026-10-27T17:17:00+00:00","modified_at":"2026-10-27T17:17:00+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}