Substance3D Designer contains a stack-based buffer overflow that can be triggered by opening a malicious file. When triggered, the overflow corrupts the stack and causes the program to crash. The result is a denial-of-service condition, limiting user availability but not compromising confidentiality or integrity.

Adobe’s Substance 3D Designer is impacted. The vulnerability applies to all versions of the product listed by Adobe but no specific version range is supplied in the CNA data. Users should verify their installation against the Adobe release notes to confirm if they are affected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation under normal circumstances. Because the flaw requires a victim to open a malicious file, it is an interactive attack that can be mitigated by user awareness and practice of safe file handling. The vulnerability is not listed in the CISA KEV catalog, further indicating limited exploitation activity so far.