This vulnerability is an out-of-bounds read that can be exploited when a malicious file is opened with Adobeager. The flaw allows an attacker to read data beyond the end of a memory buffer during parsing. An attacker can leverage this read to execute code in the context of the user who opens the file. The weakness is classified as CWE-125.

Adobe’s Substance 3D Stager software is affected. No specific version numbers are provided by the CNA, so any instance of the product that can open user-supplied files may be vulnerable.

The CVSS score of 7.8 indicates high severity, while the EPSS score is less than 1% and the vulnerability is not cataloged in CISA’s Known Exploited Vulnerabilities database. Exploitation requires user interaction, i.e., the victim must explicitly open a crafted file. The risk is therefore moderate to high for environments where users routinely import files from untrusted sources or where the product runs with privileged user rights.