Substance3D Stager has an out-of-bounds write that can enable an attacker to execute arbitrary code with the privileges of the current user. The flaw is triggered when the program processes a specially crafted file, allowing the attacker to overwrite memory beyond the intended bounds. The impact is confinement to the local user who opens the malicious file but results in full control over the system under that user’s session.

The affected product is Adobe Substance 3D Stager. No specific version ranges are listed in the CNA data, so any installation prior to the release of the official security update is considered vulnerable.

The CVSS score of 7.8 indicates a high level of severity, but the EPSS score of less than 1% suggests that the vulnerability is unlikely to be widely exploited in the wild. Because a victim must interact by opening a malicious file, the attack vector is local or user‑initiated and the vulnerability is not currently cataloged in the CISA KEV list.