Substance3D – Stager versions 3.1.6 and earlier suffer from an out‑of‑bounds write that lets a maliciously crafted file corrupt memory and spawn arbitrary code execution in the context of the current user. The flaw is a classic buffer overflow (CWE‑787). Based on the description, a successful exploit would run code as the user who opens the file without requiring additional privileges.

Adobe’s Substance3D – Stager is the sole vendor identified. The vulnerability exists in all released builds up to and including version 3.1.6. The product runs on both macOS and Windows, as indicated by the CPE entries for those operating systems. All installations of the affected versions are therefore vulnerable until patched.

The vulnerability has a CVSS score of 7.8, indicating a high severity level. The EPSS score is <1%, indicating a very low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction – an end user must open a specially crafted file. Once processed, the out‑of‑bounds write can be leveraged to gain arbitrary code execution in the user’s context, which could compromise the host process if the user has administrative rights.