Technical impact
An Untrusted Search Path vulnerability in Adobe Substance 3D Painter can allow an attacker to execute arbitrary code in the context of the user who opens a malicious file. The flaw arises when the application resolves executable paths without validating that the search directories are trusted, enabling a crafted file that points to an attacker‑controlled executable. If exploited, the attacker could gain full control over the victim’s system, compromising confidentiality, integrity, and availability of data and applications.
Affected Systems
Adobe Substance 3D Painter is the affected product. No specific version information is provided in the CNA data, so any installation that matches the vendor/product description could be vulnerable until an official patch is applied.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity vulnerability, but the EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires user interaction; the attacker must convince the victim to open a malicious file that triggers the search path resolution. Consequently, the attack vector is likely a social‑engineering or phishing scenario rather than an automated network‑based exploit. Proper mitigation reduces the risk to the level of routine application maintenance.
