This vulnerability is an out‑of‑bounds write that allows a malicious input file to corrupt memory when Substance3D Stager processes it, leading to arbitrary code execution with the privileges of the user launching the application. The weakness is classified as CWE‑787, indicating improper memory bounds handling. If successfully exploited, an attacker can run arbitrary code, compromising confidentiality, integrity, and availability of the system.

Adobe Substance3D Stager versions 3.1.7 and earlier on macOS and Microsoft Windows are affected, as indicated by the supplied CPE information. Any host running those releases should be evaluated for exposure.

The CVSS base score is 7.8, representing a high‑severity flaw. The EPSS score is less than 1 %, indicating a low likelihood of exploitation under current conditions, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction: a victim must open a specially crafted file. The likely attack vector is a social‑engineering or file‑sharing scenario, with the attacker delivering a malicious file that the user attempts to open with Substance3D Stager. Given these conditions, the risk remains significant for organizations that permit unknown files to be processed with the application.