An out-of-bounds write vulnerability in the Adobe Substance 3D Stager allows an attacker to overwrite memory beyond a buffer boundary, leading to arbitrary code execution in the context of the current user. The vulnerability is not a denial-of-service flaw but can grant full control over the affected system if successfully exploited.

Adobe Substance 3D Stager is the affected product. The CNA list does not provide specific version numbers, so any installations of the product before an available patch are presumed vulnerable.

The CVSS score of 7.8 reflects a significant impact, while the EPSS score of less than 1% indicates a low probability of observed exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation requires a victim to manually open a malicious file, which limits the attack surface to user interaction scenarios. The vulnerability is therefore moderately high in impact but low in likelihood under normal conditions.