An out-of-bounds read flaw in Adobe Substance3D Modeler allows a malicious file to expose data stored in memory, potentially leaking sensitive information. The vulnerability is a classic stable memory read error (CWE-125) that does not grant execution privileges but can reveal confidential data to the attacker. Exploitation requires the victim to open a crafted file, so it depends on user interaction rather than a network-based attack vector.

Adobe Substance3D Modeler, versions 1.22.4 and earlier are vulnerable. The affected build range extends from the initial release through 1.22.4; no statement is made about newer releases.

The CVSS base score of 5.5 places the vulnerability in the moderate category, yet the EPSS score of less than 1% indicates a very low likelihood of real-world exploitation. Because the flaw requires the victim to open a maliciously crafted file, it is a user-dependent attack vector. The vulnerability is not listed in CISA’s KEV catalog, reducing the expectation of actively exploited instances. Nonetheless, unpatched systems remain susceptible to accidental or targeted exploitation via social engineering or malicious content distribution.