Substance3D – Stager versions 3.1.7 and earlier contain an out-of-bounds write flaw that can be triggered by opening a specially crafted file. The vulnerability is a classic memory corruption bug (CWE‑787) and allows an attacker to corrupt data outside the bounds of an allocated buffer, potentially leading to execution of arbitrary code. If successfully exploited, the attacker would have the privileges of the user who opens the file, providing a direct route to compromise the system and any processes that trust the application.

The affected product is Adobe Substance3D – Stager. Versions 3.1.7 and all earlier releases are vulnerable, regardless of the operating system. The application runs on macOS, Windows, and other platforms as listed in the CPE data. No specific OS versions are limited beyond the presence of Substance3D – Stager itself.

The vulnerability has a CVSS score of 7.8, indicating high severity. The EPSS score is below 1%, suggesting low current exploitation probability, but zero-day threats can still arise. It is not yet included in the CISA KEV catalog. The most likely attack vector is a user following a malicious link or opening a deceptive file, which requires user interaction. The required privileges are at the level of the victim, making the impact significant if the user has administrative or higher rights.