Substance3D Stager 3.1.7 and earlier contain an out‑of‑bounds write that can be triggered by opening a malicious file. When this buffer overflow is exploited, an attacker can run arbitrary code with the privileges of the user who opens the file, potentially compromising the entire system.

Adobe Substance3D Stager versions 3.1.7 and earlier are affected. The product runs on macOS and Windows platforms, as indicated by the associated CPE entries, so any user who has an affected version installed on either operating system is at risk.

The vulnerability has a CVSS v3 score of 7.8, signaling high severity. Exploitation requires user interaction to open a crafted file, so the attack vector is local and likely to be confined to the victim’s machine. EPSS indicates a very low invasion probability (<1%), and the issue is not listed in CISA’s KEV catalog, suggesting no widespread, active exploitation at present. Nevertheless, the ability to execute code as the current user warrants prompt remediation.