Adobe Substance3D Stager contains a critical out-of-bounds write vulnerability that can lead to arbitrary code execution if a user interacts with a specially crafted file.

This is an out-of-bounds write vulnerability (CWE-787) triggered when the application parses a malicious file. Exploitation requires user interaction, as the victim must manually open the crafted file, at which point the attacker gains code execution in the context of the current user.

Successful exploitation allows an attacker to execute arbitrary code on the victim machine, potentially leading to a full system compromise, unauthorized data access, or the installation of persistent malware. With a CVSS score of 7.8, this vulnerability is classified as High severity, representing a significant risk to workstations and creative environments where sensitive intellectual property is handled.

Immediate Action: Update Adobe Substance3D Stager to version 3.1.7 or later to incorporate the vendor-supplied fix.

Proactive Monitoring: Review endpoint security logs for unexpected process execution or suspicious crashes associated with the Stager application.

Compensating Controls: Implement strict file-handling policies and ensure that users do not open Stager project files from untrusted or unknown sources.

Public Exploit Available: Unknown

Given the potential for arbitrary code execution and the relative ease of delivering malicious files to end users, organizations should prioritize updating all instances of Adobe Substance3D Stager to version 3.1.7 or later. Ensure that security teams verify the patch deployment across all workstations to mitigate the risk of system compromise.