Adobe Security Bulletin

Last updated on Aug 25, 2026

Security updates available for Substance 3D Painter | APSB26-129

Bulletin ID

Date published

Priority

APSB26-129

August 25, 2026

3

style

grid width 12

Summary

Adobe has released an update for Adobe Substance 3D Painter. This update addresses critical and important vulnerabilities in Adobe Substance 3D Painter that could result in arbitrary code execution and memory explosure.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Adobe Substance 3D Painter

12.1.2 and earlier versions

All

style

grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app's update mechanism. For more information, please reference this help page.

For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.

Product

Version

Platform

Priority

Availability

Adobe Substance 3D Painter

12.1.3

All

3

Download Center

style

grid width 12

Vulnerability Details

CVE-2026-75770

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-75769

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-75768

Vulnerability category: Untrusted Search Path (CWE-426)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-75767

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-75766

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-75750

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-75749

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-75752

Vulnerability category: Out-of-bounds Read (CWE-125)
Vulnerability impact: Memory exposure
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgments:

Adobe would like to thank the following researcher for reporting the relevant issues and for working with Adobe to help protect our customers:

Jony (jony_juice) — CVE-2026-75770, CVE-2026-75769, CVE-2026-75768, CVE-2026-75767, CVE-2026-75766, CVE-2026-75750, CVE-2026-75749, CVE-2026-75752

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle

APSB26-129

CardDescription

Priority 3 Security update

CardImage

Created

2026-08-25