An out‑of‑bounds write flaw in Substance 3D Stager allows a malicious file to corrupt memory and execute arbitrary code in the context of the current user. The flaw stems from writing beyond an allocated buffer, which can be exploited to inject and run code. The impact is limited to the privileges of the user opening the file, but if that user has elevated rights the consequences can affect the entire system.

Adobe Substance 3D Stager is the affected product. The advisory does not list specific affected versions, so all installations remain potentially vulnerable until the vendor issues a patch. Users should verify the installed version against Adobe’s security bulletin for fixes.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires the victim to open a malicious staging file, so user interaction is necessary. Because the flaw can lead to arbitrary code execution, timely patching and user vigilance are critical for mitigation.