Substance3D Stager versions 3.1.6 and earlier contain an out-of-bounds read flaw that triggers when the application parses a specially crafted file. The vulnerability allows an attacker to read beyond the bounds of an allocated memory buffer, potentially leading to execution of arbitrary code within the current user’s session. The weakness is classified as CWE-125.

Adobe’s Substance3D Stager, specifically release 3.1.6 and all earlier versions, is affected. The product is available on macOS and Windows platforms, making any user who installs these older versions at risk if they open a malicious file.

The CVSS score of 7.8 reflects high severity, while the EPSS score of less than 1% indicates a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Successful exploitation requires user interaction: a victim must launch the Stager application with a maliciously crafted file. Once this occurs, code can execute in the context of the current user, granting significant compromise potential but limited to users who open such files.