Substance3D Designer versions 15.1.0 and earlier contain an out‑of‑bounds write that corrupts memory when processing a malicious file, which can be leveraged to run arbitrary code in the current user’s context. This bug is a classic buffer overflow scenario that may allow an attacker to compromise the operating system or execute subsequent attacks. The effect is therefore the ability to execute malicious code with the user’s privileges.

Adobe Substance3D Designer is the affected product; only releases 15.1.0 and earlier are susceptible. Users should verify whether they are running a vulnerable version.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1 % suggests a very low probability of exploitation at present. Because the vulnerability requires the victim to open a specially crafted file, it is most often delivered via phishing emails or compromised downloads, which means that social engineering is the main attack vector. Although not listed in the CISA KEV database, the potential damage from successful exploitation is severe, so the overall risk remains moderate to high depending on user behavior and protection controls.