Substance3D Painter contains an out‑of‑bounds read flaw that can expose sensitive data from memory. An attacker can craft a malicious file that, when opened by a user, triggers the read and leaks internal information. The flaw does not provide code execution or denial of service; it is limited to confidentiality loss only.

Adobe’s Substance 3D Painter is affected. No specific versions are listed in the advisory, so all current pre‑patch releases of this product are potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not yet been documented. Because the flaw requires the victim to open a crafted file, the attack vector is user‑interaction and the likelihood of successful exploitation is moderate in environments where users freely open files from untrusted sources.