Substance3D Sampler contains an out‑of‑bounds read flaw that allows an attacker to read memory beyond the intended bounds. The vulnerability can reveal sensitive data residing in RAM at the time the problematic file is processed, and is categorized as CWE‑125. The effect is a breach of confidentiality and a potential exposure of proprietary or personal information.

Adobe’s Substance 3D Sampler is the known product impacted. No specific version numbers are disclosed in the incident data; however the flaw is documented for the product as a whole.

The CVSS score of 5.5 classifies the issue as medium severity. The EPSS score is below 1%, indicating a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires user interaction, specifically that a victim opens a crafted file, so an attacker must deceive a user into opening malicious content. With the current scoring, the risk is muted but not negligible, especially in environments where users frequently open unknown files in Substance 3D Sampler.