Substance3D – Stager versions 3.1.7 and earlier contain a use‑after‑free flaw that can empower an attacker to run arbitrary code in the context of the user who opens a malicious file. The vulnerability is a classic memory corruption bug (CWE‑416), and the official description indicates that exploitation demands user interaction: a victim must deliberately open a crafted file. If successful, the attacker can gain full control over the target system with the privileges of the logged‑in user, potentially leading to data theft, malware deployment, or a pivot to internal assets.

Adobe’s Substance3D – Stager software is affected. The issue applies to all affected releases up to and including 3.1.7, as well as any platforms that run that code, notably macOS and Windows environments that host the application.

The CVSS score of 7.8 reflects a high severity, and the EPSS score of less than 1% shows that, at the time of this analysis, the probability of exploitation is low. However, because the flaw allows full user‑level code execution and exploitation requires only a malicious file, the risk to organizations that enable users to open or drag files into the application is significant. The vulnerability is not listed in the CISA KEV catalog, but its nature and impact warrant immediate attention.