The vulnerability is a use‑after‑free flaw that allows an attacker to execute arbitrary code in the context of the logged‑in user. The flaw arises when a corrupted memory reference is used after a deallocation, which can be leveraged to launch malicious code. Its impact is the ability to take full control of the victim’s system, potentially compromising confidentiality, integrity, and availability.

The affected product is Adobe Substance 3D Stager. No specific version range is listed in the data, so all installations of the product may be vulnerable until a patch is released.

The CVSS base score of 7.8 indicates a high severity. The EPSS score of 0.00176 (<1%) indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no known large‑scale exploitation has been observed yet. Exploitation requires the victim to open a malicious file, so the attack vector is typically a user‑interaction scenario such as phishing or social engineering. Once the victim opens the file, the use‑after‑free can lead to remote code execution in the user’s context.