This vulnerability is an out‑of‑bounds write that can lead to arbitrary code execution in the context of the current user. An attacker must first trick a user into opening a malicious file for exploitation to occur. The CVSS score of 7.8 indicates that successful exploitation presents a moderate‑to‑high level of risk, potentially compromising the machine and any data accessible to the user.

The affected product is Adobe Substance 3D Stager. No specific version information is supplied in the advisory, so any installation of this application is potentially vulnerable until a vendor patch is applied.

The EPSS score is below 1 %, suggesting that active exploitation of this flaw is currently rare. However, the vulnerability is not listed in the CISA KEV catalog, which does not eliminate the risk of targeted attacks. Exploitation requires user interaction – the victim must open a crafted file – which mitigates remote attack feasibility but still poses a significant threat in social‑engineering or phishing scenarios. The CVSS score of 7.8 emphasizes the importance of addressing the flaw before it is widely exploited.