The vulnerability is an out-of-bounds read in the file parsing routine of Substance3D Painter, allowing an attacker to read memory contents beyond the intended buffer. This can lead to the disclosure of sensitive data stored in memory. The flaw is classified as CWE‑125. Exploitation requires the victim to open a crafted file, causing the application to perform the unsafe memory read while rendering.

Adobe Substance3D Painter versions 11.1.2 and all older releases are affected. User installations of these versions on any supported operating system are vulnerable. Upgrading to a newer release that removes the vulnerable code eliminates the risk.

The CVSS v3 score of 5.5 indicates a medium risk level. The EPSS score of below 1 % suggests an unlikely exploitation probability under current conditions. The vulnerability does not appear in the CISA KEV catalog. Attackers must rely on social engineering to convince a user to open a maliciously crafted file; based on the description, it is inferred that the attack vector is local and file-based, with no remote code execution or privilege escalation. The potential impact is limited to information disclosure rather than code compromise.