The vulnerability is an out-of-bounds read (CWE-125) in Substance3D Designer versions 15.1.0 and earlier, which can expose arbitrary data stored in memory to an attacker. It allows adversaries to read data beyond a buffer boundary when a malicious file is opened, potentially leaking sensitive information such as credentials or proprietary assets. The impact is primarily confidentiality loss; there is no direct evidence of code execution or denial of service.

Adobe Substance3D Designer is affected, specifically versions 15.1.0 and earlier. No other vendors or products are listed. Therefore, any installation of the product within that version range is vulnerable.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1%, showing that the likelihood of exploitation is low. The vulnerability is not included in the CISA KEV list, suggesting it is not currently being exploited in the wild. Attack requires user interaction to open a malicious file, so the risk is mitigated if users are cautious, but patching remains the recommended action.