An out‑of‑bounds write in Adobe Substance 3D Stager permits an attacker who successfully tricks a user into opening a specially crafted file to execute arbitrary code with the privileges of that user. The vulnerability is classified as CWE‑787 and is considered exploitable only when the user interacts with the malicious content.

The vulnerability affects Adobe Substance 3D Stager. No specific version information was disclosed, so all installations of this product are potentially affected until a vendor patch is applied.

The CVSS score of 7.8 indicates a high risk, but the EPSS score of less than 1% shows the probability of real‑world exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. Because user interaction is required, the attack vector is likely a local file that the victim opens, meaning that an adversary would need to deliver the malicious file through phishing or other social engineering tactics.