This vulnerability is an out-of-bounds write that can lead to arbitrary code execution in the context of the user who opens a malicious file. The weakness is a classic bounds-checking failure (CWE‑787). An attacker must supply a specially crafted file that the user opens to trigger the exploit, giving the attacker execution privileges as the current Windows user.

Adobe Substance3D Sampler versions 6.0.0 and earlier are vulnerable. No other vendors or versions are listed.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the vulnerability is listed in CISA KEV as not present, implying no known active exploitation. The attack vector requires user interaction (file opening) and is local. If an attacker succeeds, they could execute arbitrary code as the logged‑in user, impacting confidentiality, integrity, and availability of the system.