Substance3D Sampler contains an out‑of‑bounds write that can be triggered by opening a crafted file, allowing an attacker to execute arbitrary code in the current user’s context. The flaw is a classic buffer overflow where data written beyond the allocated memory corrupts control structures or function pointers. Once executed, the attacker can gain full control of the application and potentially the host system.

The vulnerability affects all installations of Adobe Substance 3D Sampler. No specific version numbers are disclosed, but any instance of the product that has not applied the Adobe security bulletin is potentially vulnerable.

The CVSS score of 7.8 indicates a significant impact, while the EPSS score of less than 1% suggests low current exploitation probability. The issue is not listed in CISA’s KEV catalog, further implying limited active exploitation. The required user interaction – the victim must open a malicious file – constrains the attack to scenarios where the product is used in a permissive environment or where file handling policies are lax. Overall, the risk remains high for environments that allow arbitrary file processing without validation.