Adobe Substance3D - Painter versions 12.0.2 and earlier contain an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution in the context of the current user. Successful exploitation depends on the victim opening a malicious file, which triggers the vulnerability. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges required, user interaction is needed, and it impacts confidentiality, integrity, and availability with high severity. There is no vendor advisory or patch information currently available to confirm remediation status.

If exploited, this vulnerability could allow an attacker to execute arbitrary code with the same privileges as the current user, potentially leading to full compromise of the user's environment within the scope of the application. The requirement for user interaction limits the attack vector to scenarios where the user opens a malicious file. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources to avoid triggering this vulnerability.