Adobe Substance 3D Designer versions 15.1.1 and earlier contain an out-of-bounds write vulnerability that could lead to arbitrary code execution upon opening a malicious file.

This vulnerability is an out-of-bounds write (CWE-787) flaw occurring when the software processes specially crafted files. An attacker can trigger this issue if a user opens a malicious file, meaning the vulnerability requires local user interaction.

Successful exploitation allows an attacker to execute arbitrary code within the security context of the current user. Given the CVSS score of 7.8, this represents a high risk because it could lead to full system compromise, unauthorized data access, or the deployment of further malicious payloads.

Immediate Action: Update Adobe Substance 3D Designer to version 15.1.2 or later to apply the official security patch.

Proactive Monitoring: Monitor system logs for unusual application crashes or unexpected file access patterns following the execution of Substance 3D Designer.

Compensating Controls: Exercise caution when opening files from untrusted sources and ensure that endpoint protection software is configured to scan files before they are processed by the application.

Public Exploit Available: No (exploit_available: false)

The risk posed by this vulnerability is significant due to the potential for arbitrary code execution. Administrators should prioritize updating all instances of Adobe Substance 3D Designer to version 15.1.2 or newer to eliminate the underlying out-of-bounds write flaw and prevent potential compromise.