Substance 3D Stager contains an out‑of‑bounds write flaw that can be triggered by opening a specially crafted file. The vulnerability can lead to arbitrary code execution, allowing an attacker to run malicious code with the privileges of the user who opens the file.

The affected product is Adobe Substance 3D Stager. Specific version information is not disclosed, so all installations of the product should be considered potentially vulnerable until a vendor supply of a patched version is confirmed.

The flaw carries a CVSS score of 7.8, indicating a high severity. The EPSS score is below 1 %, implying a very low but not zero probability of exploitation in the wild, and it is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires user interaction—an attacker must convince a victim to open a malicious file. Based on the description, it is inferred that the flaw is local rather than network‑exposed, so the attack surface is limited to users who have access to, and trust, the application. Nonetheless, the potential for arbitrary code execution makes this a serious risk for systems that handle untrusted files or are exposed to phishing attacks.