Description

Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-25T18:18:04.097Z",
  "pubdate": "2026-08-25T18:18:04.097Z",
  "executiveSummary": "Substance3D Painter is susceptible to an Untrusted Search Path vulnerability, categorized as a DLL hijacking or search order vulnerability. This flaw allows a remote attacker to execute arbitrary code within the security context of the current user session.\nThe vulnerability manifests when the application incorrectly searches for external dependencies—such as dynamic link libraries (DLLs)—in insecure directory locations, such as the current working directory, before searching in protected system directories. By placing a malicious, similarly-named library in a directory accessible to the user, an attacker can hijack the application's loading process.\nSuccessful exploitation requires user interaction; specifically, the victim must open a malicious file (such as a project file or asset) located within a directory controlled by the attacker. Upon execution, the malicious payload inherits the privileges of the victim's process, potentially leading to a full system compromise, data theft, or persistence. This vulnerability poses a significant risk as it circumvents standard security boundaries through manipulated file system environments.",
  "technicalDetails": "The root cause of this vulnerability lies in the application's failure to adhere to secure DLL loading practices. When Substance3D Painter initializes or attempts to load required modules during execution, it defaults to an insecure search order. Windows systems typically prioritize the directory from which the application is launched, or the directory containing the file being opened, when resolving path dependencies. If the application does not explicitly use absolute, fully qualified paths to load its dependent DLLs, it becomes vulnerable to search order manipulation.\nThe attack flow begins when an attacker prepares a weaponized directory containing both a benign Substance3D Painter project file and a malicious DLL. The malicious DLL is renamed to match a legitimate library that the application expects to load during its normal operation. When the victim interacts with the malicious file—typically by opening it through the application or via a double-click event—the application triggers an internal module load request.\nBecause the application is executing within the user's current directory context, the OS search mechanism discovers the attacker-supplied DLL first. The application, lacking integrity verification for the loaded module, proceeds to map the malicious library into its process memory space. Once mapped, the DllMain function of the malicious payload is executed with the privileges of the Substance3D Painter process. This execution occurs in the context of the user, allowing the attacker to perform any action permitted by the user's security token, including local enumeration, credential harvesting, or deploying secondary payloads.\nThis vulnerability does not require prior authentication or elevated privileges, as the exploit relies on standard user-mode execution flows. The primary requirement is the successful delivery and subsequent opening of the malicious file, often facilitated via social engineering or inclusion in shared, untrusted project folders. Since the malicious code executes as the user, the post-exploitation impact includes the potential for persistent backdoors and unauthorized access to sensitive application data or system-level resources, depending on the victim's current user access rights."
}