Substance3D Designer versions 15.1.0 and earlier contain an out‑of‑bounds write vulnerability (CWE‑787) that can allow an attacker to execute arbitrary code in the context of the current user. The flaw is triggered when a user opens a specially crafted file; no additional privileges or authentication beyond the user account are required. This means that if a user launches a malicious file, the attacker could gain full control of the system, compromising confidentiality, integrity, and availability.

Adobe Substance3D Designer is affected. All releases up to and including version 15.1.0 are vulnerable. No other Adobe products are listed as impacted by this specific issue.

The CVSS score of 7.8 signifies high severity, and while an EPSS score is not available, the vulnerability requires user interaction and is therefore likely to be exploited through social engineering or malicious content distribution. The issue is not listed in CISA’s KEV catalog, indicating no known publicly documented exploitation at this time. Attackers would need to convince a user to open a crafted Designer file, after which arbitrary code execution would occur.