The vulnerability is an out-of-bounds write in Adobe Substance3D – Sampler that can be triggered by opening a malicious sampler file. When processed, the software fails to ensure that data written to memory stays within the bounds of an allocated buffer, allowing an attacker to overwrite adjacent memory and execute arbitrary code with the privileges of the current user. The flaw is a classic input validation issue (CWE‑787).

Adobe Substance3D – Sampler versions 6.0.0 and earlier contain the flaw. Systems running these versions are vulnerable; any installation that allows opening sampler files likely resides at risk. Newer releases, released after the advisory, are considered fixed.

The CVSS score of 7.8 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting no large‑scale, automated exploitation yet. Exploitation requires user interaction: a victim must open a crafted sampler file, typically delivered via email, download, or other means. If this condition is met, the attacker can gain code execution in the context of the user, making the risk significant for end‑users and environments that automatically open such files.