Substance3D – Sampler is vulnerable to an out‑of‑bounds write that allows an attacker to overwrite arbitrary memory locations. This flaw can lead to arbitrary code execution with the privileges of the user who opens a malicious file.

Adobe’s Substance3D – Sampler versions 6.0.0 and earlier are affected. Affected installers include any release of the software before the 6.0.1 update. The vulnerability is noted by Adobe’s advisory and does not affect newer releases beyond 6.0.0.

The CVSS score of 7.8 indicates a high likelihood of successful exploits in a realistic scenario. While EPSS data is not available, the lack of a KEV listing suggests no mass exploitation is currently documented. The attack requires user interaction: the victim must open a crafted file. In practice, it is a local‑file, user‑initiated vector, so the risk is mitigated by restricting file handling, but it remains a high severity vulnerability.