This vulnerability is a stack-based buffer overflow in Adobe Substance 3D Painter that could allow a malicious actor to execute arbitrary code within the victim’s user context. The defect arises when the program processes a crafted file, overflowing the stack and enabling the attacker to inject and run code. No additional privileges are required beyond those possessed by the user opening the file.

Adobe Substance 3D Painter (all current versions) is potentially vulnerable; no specific version guidance is available. Until a vendor patch is released, all current releases may be susceptible.

The CVSS score of 7.8 indicates a high severity with potential for complete compromise relative to the user context. EPSS data is currently unavailable, and the issue is not catalogued in CISA’s KEV list, so the likelihood estimate is uncertain. Exploitation requires the victim to open a specially crafted file, implying a user‑interaction attack vector. Given the high impact and the need for user action, the overall risk is moderate to high for environments where users routinely handle unknown files.