Broadcaster ATV reported that the other two victims were a 26-year-old woman and a 28-year-old man.
A witness told the Wiener Zeitung newspaper that dead bodies were left lying face down in the street after the vehicle sped through the historic Herrengasse and Hauptplatz in Graz, Austria's second-largest city, at a speed of over 100 kilometres (60 miles) per hour.
34 pedestrians were injured during the episode - ten of them seriously, with six people reported to be in a critical condition.
The driver of the SUV, reportedly a 26-year-old Austrian man of Bosnian heritage, has been arrested and the area sealed off.
According to a police spokesman, the suspect has "no connection with fanaticism and no terrorist background.” It is believed the man was suffering from personal problems and he has been described as "mentally imbalanced".
Newspaper reports say that he has two children and is going through a break-up with his wife.
The Austria Press Agency cited a police source as saying the driver showed symptoms of "psychosis".
Witnesses told the Kronen Zeitung that he was "laughing" as he accelerated the car, and that he deliberately drove into pedestrians.
"People were screaming in panic and ran into shops to get to safety," an eyewitness said.
The city's mayor, Siegfried Nagl, personally witnessed the incident and told the Kleine Zeitung newspaper that he saw a woman being run over.
The suspect reportedly stopped his car not far from a police station and did not resist arrest.
An earlier report in the Wiener Zeitung that he had also got out of the car and attacked pedestrians with a knife was unconfirmed.
ATV said that the suspect was known to police because of a previous domestic violence incident.
60 police cars and ambulances gathered on Herrengasse and Hauptplatz and four rescue helicopters were called to the scene.
Austrian President Heinz Fischer said he was "deeply shocked" by the attack.
14844, a hotline for relatives and victims, has been set up.