An out‑of‑bounds write vulnerability exists in Substance3D – Designer versions 15.1.0 and earlier, allowing an attacker to corrupt memory and ultimately execute arbitrary code with the privileges of the user running the application. The flaw resides in how the program processes certain user‑supplied data and can be triggered by a malicious file that the user opens.

Adobe’s Substance3D – Designer product, affecting all installations at version 15.1.0 and earlier.

The CVSS score of 5.5 indicates moderate severity, and while EPSS data is not available, the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to open a malicious file, making user interaction a prerequisite. Attackers can gain code execution only in the context of the current user; however, this still permits installation of malware, data theft, or other malicious actions that benefit the attacker. Consequently, the risk is moderate but non‑negligible, especially in environments where users frequently handle untrusted files.