An out‑of‑bounds write in Adobe Substance3D Designer versions 15.1.0 and earlier allows an attacker to trigger arbitrary code execution when a user opens a crafted file. The flaw is a classic memory corruption issue identified as CWE‑787. If exploited, the malicious code runs with the privileges of the user who opens the file.

Adobe Substance3D Designer (Designer version 15.1.0 and any earlier releases).

With a CVSS score of 7.8, this vulnerability is considered high severity. However, its EPSS score is below 1 %, indicating low current exploitation likelihood. The vulnerability is not listed in CISA KEV. Exploitation requires user interaction to open a malicious file, so threat actors would need to persuade or trick a user into opening the file. If successfully exploited, code could run with the user’s rights, potentially allowing data exfiltration or privilege escalation within the user’s session.