Substance3D Stager suffers an out‑of‑bounds write that can lead to arbitrary code execution when a user opens a malicious file. The vulnerability is categorized as CWE‑787 and gives an attacker the ability to overwrite memory beyond the bounds of a buffer, potentially allowing the execution of injected code inside the current user context.

Adobe Substance 3D Stager is the affected product. No specific version information was supplied in the data, but all installations of the Stager application are considered vulnerable unless patched.

The CVSS score of 7.8 indicates a high impact severity. The EPSS score is under 1 %, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation would require a victim to actively open a crafted file, meaning user interaction is a prerequisite. An attacker could place a crafted file on a shared drive or send it via email and persuade the victim to open it, at which point the out‑of‑bounds write could enable local code execution.