An out‑of‑bounds write flaw in Adobe Substance3D Painter allows an attacker to overwrite memory, leading to arbitrary code execution under the victim’s user account. The vulnerability is triggered when the application processes a specially crafted file; no elevated privileges or additional access is required. The impact is confined to the user who opens the malicious file and could result in system compromise.

Adobe Substance3D Painter versions 11.0.3 and earlier are affected. Users running these releases should verify their installed version against the vendor’s release notes. Production systems using these or earlier builds are susceptible.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low exploitation probability at the current time. The vulnerability is not listed in the CISA KEV catalog. Exfiltration requires a user to open a crafted file, so the attack vector is local and user‑initiated. An attacker must exploit the application to execute code, making exploitation feasible but dependent on user interaction.