Substance3D – Stager versions 3.1.7 and earlier suffer from a use‑after‑free flaw that allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. The vulnerability is rated CVSS 7.8, indicating a high‑severity security impact. Exploitation requires user interaction: a victim must open the malicious file, after which the attacker can inject code that runs with the victim’s privileges.

Adobe’s Substance3D – Stager, specifically versions 3.1.7 and older, are affected. The flaw is applicable on both macOS and Windows platforms, as the product runs on these operating systems.

The CVSS score of 7.8 conveys a significant risk, while the EPSS score of less than 1% suggests that, at present, the probability of exploitation is low but not zero. The lack of a listing in the CISA KEV catalog indicates no confirmed exploitation in the wild, yet the attack path is straightforward: craft a malicious file, convince a user to open it, then trigger the use‑after‑free and achieve code execution. Because the exploit runs with the current user’s privileges, it can potentially expand to other user accounts or system resources if higher‑privileged processes interact with the compromised materials.