An out‑of‑bounds read flaw in Substance3D – Designer allows an attacker to read beyond intended memory bounds. The vulnerability can cause disclosure of sensitive data residing in memory. It stems from an improper bounds check (CWE‑125) and requires that a victim open a crafted file to trigger the read. The impact is the exposure of confidential information but does not directly allow remote code execution.

Adobe Substance3D – Designer versions 15.1.0 and earlier are vulnerable. Updated versions released after 15.1.0 contain the fix.

The CVSS base score of 5.5 indicates a moderate severity. EPSS is below 1%, suggesting the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires user interaction, so an attacker must convince a user to open a malicious file; otherwise the flaw cannot be leveraged.