Code execution via attacker-controlled resource search path

Untrusted search path handling in Adobe Substance 3D Painter 10.1.0 and earlier allows attackers to execute code via a malicious file. When Painter opens the file, its critical-resource lookup accepts an attacker-influenced search path and executes a malicious program found there. A local user must open the crafted file; successful execution runs code with the privileges of the Painter process.