Adobe Substance 3D Designer is affected by a critical out-of-bounds write vulnerability that can lead to arbitrary code execution if a user opens a specially crafted file.

This vulnerability is an out-of-bounds write (CWE-787) flaw occurring within the application. It requires user interaction, specifically the opening of a malicious file by a victim, to trigger the execution of arbitrary code in the context of the current user.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the victim, which could lead to a full system compromise. Given the CVSS score of 7.8, the risk is high because it provides a mechanism for threat actors to gain unauthorized control over user workstations and potentially pivot into internal network environments.

Immediate Action: Update Adobe Substance 3D Designer to version 15.1.2 or later to apply the necessary security fixes.

Proactive Monitoring: Monitor endpoint activity for unusual process execution or unauthorized file modifications originating from the Substance 3D Designer application.

Compensating Controls: Implement strict email and file-transfer filtering to prevent users from opening untrusted or unsolicited project files from unknown sources.

Public Exploit Available: No

Organizations should prioritize patching all instances of Adobe Substance 3D Designer to the fixed version, 15.1.2. Users should be cautioned against opening files from untrusted sources, as the primary attack vector relies on the successful opening of a malicious file.