An out‑of‑bounds write flaw exists in Substance3D Sampler versions 6.0.0 and earlier. The vulnerability can be triggered by opening a specially crafted file, resulting in arbitrary code execution running with the privileges of the user who opens the file. This flaw is a classic CWE‑787 pointer corruption, giving an attacker the means to compromise confidentiality, integrity, and availability of the affected system.

The Adobe Substance3D Sampler product is affected. All releases up to and including version 6.0.0 are vulnerable; later versions are presumed fixed but the exact version boundaries are not listed in the data provided.

The CVSS score of 7.8 indicates a high severity, and although the EPSS score is not available, the lack of a KEV listing suggests no widespread exploitation has been observed yet. Exploitation requires user interaction—specifically, the victim must open a malicious file with Substance3D Sampler. Consequently the attack vector is inferred to be local; an attacker can deliver the file via social engineering, email attachments, or other mechanisms that prompt the user to open it. Given the potential for arbitrary code execution, the risk to affected systems remains elevated until a patch is applied.