Substance3D Designer contains an out‑of‑bounds read flaw that can expose sensitive data resident in memory. The vulnerability is classified as CWE‑125, meaning an attacker may read data beyond the intended buffer. The impact is limited to confidentiality; no direct code execution, privilege escalation, or denial of service capability is noted.

Adobe’s Substance 3D Designer is affected. No specific version ranges are listed in the advisory, so all installations of the product are potentially vulnerable until a patch is applied.

The CVSS score of 5.5 indicates moderate risk. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not currently in the CISA KEV catalog. Exploitation requires the user to open a malicious file, so the attack vector is user interaction. Once a file is opened, the out‑of‑bounds read can reveal sensitive information, potentially giving an adversary insights into system memory or application internals.