An out‑of‑bounds write has been discovered in Substance3D Painter. The flaw (CWE‑787) allows an attacker, by delivering a crafted file, to overwrite memory outside a buffer and potentially execute code with the privileges of the user who opens the file. The vulnerability can cause loss of confidentiality, integrity, and availability because it permits the execution of arbitrary instructions.

The issue affects Adobe Substance3D Painter versions 12.0.2 and earlier. Any installation outside that version range is considered safe. The vulnerability is specific to the desktop product and does not extend to other Adobe offerings.

The CVSS score of 7.8 indicates a high severity problem. While an EPSS score is not published, the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Exploitation requires user interaction: the victim must open a malicious file. Consequently, the risk is significant for users who frequent unknown file sources, and the attacker cannot compromise systems remotely without that interaction.