An out‑of‑bounds write vulnerability exists in Substance3D – Designer versions 15.1.0 and earlier, allowing an attacker to corrupt memory and ultimately execute arbitrary code with the privileges of the user running the application. The flaw resides in how the program processes certain user‑supplied data and can be triggered by a malicious file that the user opens.

Adobe’s Substance3D – Designer product, affecting all installations at version 15.1.0 and earlier.

The CVSS score of 7.8 indicates high severity, and the EPSS score is 0.00028 (less than 1%), indicating a very low probability of exploitation, while the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to open a malicious file, making user interaction a prerequisite. Attackers can gain code execution only in the context of the current user; however, this still permits installation of malware, data theft, or other malicious actions that benefit the attacker. Consequently, the risk is high but non‑negligible, especially in environments where users frequently handle untrusted files.