Adobe Substance3D Stager versions 3.1.7 and earlier contain a Use After Free vulnerability that enables arbitrary code execution when a user opens a specially crafted file.

The software is susceptible to a Use After Free vulnerability, which occurs when an application continues to use a memory pointer after the associated memory has been freed. Exploitation requires user interaction, specifically forcing a victim to open a malicious file, which allows an attacker to execute arbitrary code in the context of the current user.

Successful exploitation of this vulnerability could lead to a complete compromise of the user workstation, allowing an attacker to execute arbitrary commands, access sensitive data, or install persistent malware. With a CVSS score of 7.8, this flaw is categorized as High severity, representing a significant risk to organizational assets that rely on this software for creative workflows.

Immediate Action: Update Adobe Substance3D Stager to version 3.1.8 or later, as provided in the vendor security advisory.

Proactive Monitoring: Monitor workstation security logs for unexpected process spawns or abnormal memory usage patterns following the execution of Substance3D Stager.

Compensating Controls: Ensure that users are instructed to avoid opening untrusted or unexpected files within the application, and maintain up to date endpoint protection software to detect malicious file signatures.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for arbitrary code execution, this vulnerability poses a severe risk to any environment where Adobe Substance3D Stager is deployed. Administrators must prioritize the deployment of version 3.1.8 to remediate the memory corruption flaw and neutralize the threat of malicious file-based attacks.