Substance3D Painter versions earlier than 12.0.2 contain an out‑of‑bounds write (CWE‑787) that can be used to overwrite memory and execute arbitrary code when a user opens a crafted file. The flaw does not allow remote exploitation; the attacker must supply a malicious file and the victim must interact with it, typically by double‑clicking or opening the file within the application.

Adobe Substance3D Painter 12.0.2 and earlier are affected.

The CVSS score of 7.8 indicates a high severity vulnerability, but the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Exploitation requires user interaction through a malicious file, meaning the attack is local and depends on the user opening the infected document. While the risk is significant for users who regularly open external files, the lack of a remote exploit vector reduces the overall threat compared to remote code execution scenarios.