Substance3D Stager contains an out‑of‑bounds write (CWE‑787) that, if triggered, can allow an attacker to execute arbitrary code with the privileges of the user who opens a crafted file. The vulnerability is triggered only when the target user opens a malicious file; thus, it is a user‑interaction required flaw that can compromise confidentiality, integrity, and availability of the victim’s system.

Adobe Substances3D Stager versions 3.1.6 and earlier are susceptible. The affected product runs on both Windows and macOS platforms, as indicated by the provided CPE identifiers.

The CVSS score of 7.8 reflects a moderate‑to‑high risk; the EPSS score is below 1 %, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack surface requires the victim to open a malicious file, so remote exploitation is not possible under normal conditions.