The vulnerability is an out‑of‑bounds read triggered when Substance3D Stager parses a crafted file, allowing a malicious actor to read data beyond the allocated buffer and potentially execute code as the current user. It aligns with CWE‑125 and presents a serious remote code execution risk if a user opens a malicious file.

Adobe Substance3D Stager versions 3.1.6 and earlier are affected. The application runs on both macOS and Windows platforms, so users on either operating system are vulnerable when they open a malicious file.

The issue carries a CVSS base score of 7.8, flagging it as high severity, while the EPSS score indicates a very low exploitation likelihood (<1 %). It is not listed in the CISA KEV catalog. An attacker must convince a user to open the crafted file, so the attack vector is file‑based user interaction. The flaw can lead to code execution, but current exploitation probability remains low under typical conditions.