This vulnerability is a stack‑based buffer overflow that allows an attacker to execute arbitrary code within the context of the user who opens a crafted file. The weakness lies in insufficient bounds checking when processing certain file types, giving the attacker the ability to overwrite return addresses on the stack. If successfully exploited, the attacker could gain full control over the compromised user machine.

The affected product is Adobe Substance 3D Sampler. No specific version range is listed, so any installation of the current product could be vulnerable until an update is applied.

The CVSS score of 7.8 indicates high severity, and the EPSS score is less than 1%, meaning the probability of the vulnerability being exploited in the near term is low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the victim to open a malicious file, implying that user interaction is necessary for the attack to proceed. The overall risk is significant for environments where users routinely process untrusted files from unknown sources.