Substance3D Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. The flaw allows an attacker to access sensitive information stored in memory when a victim opens a malicious file. Exploitation requires user interaction; no remote exploitation is possible.

Adobe’s Substance3D Painter version 11.1.2 and all earlier releases are vulnerable. Any installation that can open or parse user-supplied files is at risk.

The vulnerability has a CVSS base score of 5.5, indicating moderate severity. The EPSS score is less than 1 %, suggesting a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the victim to open a malicious file, so the primary risk is mitigated by user awareness and file-handling controls rather than purely technical defenses.