Substance3D Painter versions 11.1.2 and older contain an out‑of‑bounds read that allows a malicious file opened by a user to expose internal memory contents and potentially reveal confidential data. The flaw is classified as CWE‑125. This vulnerability enables an attacker to read beyond the allocated buffer and capture sensitive information from the victim’s process memory.

Adobe’s Substance3D Painter, specifically installations running version 11.1.2 or earlier, are affected. All other versions released after 11.1.2 are not listed in the advisory and are presumed to be mitigated.

The CVSS base score is 5.5, indicating moderate impact if exploited. EPSS indicates a very low likelihood of exploitation (<1%) and the vulnerability is not currently listed in CISA’s KEV catalog. Because it requires user interaction—someone must open a crafted file—its real‑world exploitation probability is low, yet the potential for confidential data leakage warrants proactive mitigation. No official patch is yet available in the advisory, so organizations should keep the product updated when releases are issued.