Substance3D Stager contains an out‑of‑bounds write flaw that can be triggered by opening a crafted file. The vulnerability allows an attacker to overwrite memory beyond array bounds, which can lead to execution of attacker‑supplied code with the privileges of the user who opens the file. This type of buffer overflow weakness can compromise confidentiality, integrity, and availability of the affected system by installing malware, exfiltrating data, or elevating privileges within the user’s environment.

Adobe Substance 3D Stager is the affected product. The advisory does not specify which versions are vulnerable; it only indicates that a critical out‑of‑bounds write flaw exists in the application. Because no version exclusions are listed, administrators should treat all current releases as potentially affected until the vendor provides a definitive affected‑version statement or a patch.

The CVSS score of 7.8 denotes a high severity impact, while the EPSS score of less than 1% indicates a low probability of widespread exploitation. The vulnerability is listed as not being in the CISA KEV catalog. Exploitation requires a victim to open a malicious file, so the attack vector depends on user interaction. Although the likelihood of automation attacks is low, an individual who opens a crafted document can immediately trigger arbitrary code execution.