The vulnerability is a use‑after‑free flaw that allows an attacker to execute code in the context of the current user. When a malicious file is opened, the program accesses freed memory, which can be manipulated to launch arbitrary instructions. This grants full control of the affected system to an attacker who successfully exploits the flaw.

Adobe Substance3D – Stager versions 3.1.7 and earlier on Windows and macOS operating systems are impacted. Any installation of the application that has not been upgraded beyond version 3.1.7 is vulnerable.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction: the victim must open a specially crafted file that triggers the use‑after‑free code path. Once compromised, the attacker gains full privileges of the user account that launched the application.