Substance3D - Designer versions 15.0.3 and earlier are vulnerable to an out‑of‑bounds read that may expose arbitrary memory contents. The flaw occurs when the program accesses data beyond the bounds of a buffer, classified as CWE‑125, and could allow an attacker to leak sensitive information such as credentials or cryptographic material. The attack requires a user to open a malicious file, so it is a local, user‑initiated threat rather than a remote exploit.

Adobe Substance3D - Designer installations running version 15.0.3 or earlier are affected.

Risk is moderate. The CVSS score of 5.5 indicates a medium impact restricted to memory disclosure, while an EPSS of less than 1% suggests exploitation attempts are uncommon. The vulnerability is not listed in CISA KEV, implying no widespread exploitation. Attackers must prompt a user to open a malicious file, limiting the attack surface to individuals who interact with the file. The limited exposure scope reduces the probability of successful exploitation compared to remote vulnerabilities, but the confidentiality impact remains non‑negligible.