Substance3D Designer is vulnerable to an out-of-bounds read that could expose sensitive memory contents. This flaw enables an attacker to read memory that the application should not have access to, leading to disclosure of potentially confidential data. The weakness is directly classified as CWE-125, indicating an improperly bounded memory access.

Adobe’s Substance 3D Designer is affected. Specific version details are not provided in the available data, so any installations of Substance 3D Designer remain potentially vulnerable until an update is applied.

The CVSS score of 5.5 indicates a medium severity impact, and the EPSS score is less than 1 percent, suggesting the probability of exploitation in the wild is currently very low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction: a victim must open a maliciously crafted file. Consequently, the attack surface is limited to environments where users routinely open unknown design files.