An out‑of‑bounds write vulnerability in Substance3D – Stager versions 3.1.7 and earlier allows an attacker to execute arbitrary code with the privileges of the user who opens a crafted file. The flaw manifests when the application processes a maliciously constructed file, enabling code to run without needing elevated rights.

Adobe’s Substance3D – Stager is impacted, specifically releases 3.1.7 and older. The software runs on multiple operating systems, including macOS and Windows, as indicated by the associated CPE entries. Any system that has an unpatched version of this product is susceptible.

The vulnerability scores a 7.8 on the CVSS vector, indicating high severity, yet the EPSS indicates a very low probability of exploitation (<1%). It is not listed in CISA’s KEV catalog. Exploitation requires human interaction – the victim must open a malicious file – so the primary vector is social engineering or phishing. Because the flaw involves an out‑of‑bounds write (CWE‑787), attackers can influence memory corruption to achieve arbitrary code execution. The impact is total loss of confidentiality, integrity, and availability of the affected machine.