Substance3D Designer is vulnerable to an out-of-bounds write that can lead to arbitrary code execution in the context of the current user. The flaw occurs when processing a crafted file, allowing an attacker to alter memory beyond intended bounds, resulting in potential code execution. This vulnerability aligns with CWE-787 and can compromise confidentiality, integrity, and availability of the affected system.

Adobe Substance 3D Designer is the affected product. Version details are not specified in the advisory; users should refer to Adobe’s security advisory to determine if their installed version is affected.

The CVSS score of 7.8 indicates high severity, and the EPSS score of 0.00148 (0.148%) indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Exploitation requires user interaction: a victim must open a malicious file, meaning the attack vector is local or remote file‑based through user downloads or file sharing. Social engineering or phishing can be used to deliver the malicious file, after which the out‑of‑bounds write is triggered during file parsing.