An out‑of‑bounds write in Adobe Substance3D Modeler versions 1.22.4 and earlier allows an attacker to execute arbitrary code in the context of the current user. The vulnerability is a classic buffer overflow (CWE‑787) that can be triggered when the affected application processes a specially crafted file. If exploited, the attacker could run malicious code with the privileges of the local user, potentially compromising system integrity and confidentiality.

Adobe Substance3D Modeler version 1.22.4 and all earlier releases are affected. Users operating any of these versions are exposed to the risk until a patch is applied.

The CVSS base score of 7.8 classifies the flaw as high severity, however the exploitation probability is very low (EPSS < 1%) and the vulnerability is not listed in CISA’s KEV catalog. Because an attacker must supply a malicious file that the user must open, the risk is limited to environments where users can inadvertently or intentionally open such files. The likely attack vector therefore involves a user manually opening a crafted file via the standard file import workflow or by dragging a file into the application.