The vulnerability is an out‑of‑bounds write in Adobe Substance3D Designer that permits the execution of arbitrary code within the user’s context. It exists in versions 15.1.0 and earlier and requires a malicious file to be opened before the software writes beyond its intended memory boundary, potentially overwriting critical data or instructions. The flaw provides an attacker with the ability to run code with the privileges of the user who opens the file.

Adobe Substance3D Designer versions 15.1.0 and all earlier releases are affected. Any installation of these versions on supported operating systems that processes user supplied files is vulnerable.

The CVSS score of 5.5 indicates a moderate overall severity. Exploitation requires user interaction—specifically opening a crafted file—so the attack vector is limited to environments where users can receive malware. The EPSS score is not available and the vulnerability is not listed in the CISA KEV, suggesting no documented exploitation in the wild. Nevertheless, the possibility of arbitrary code execution warrants prompt remediation.