Description
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential code execution via out‑of‑bounds read in Adobe Substance 3D Stager
Action: Apply Patch
AI Analysis

Impact

Substance 3D Stager is vulnerable to an out‑of‑bounds read when processing a crafted file. The read past the end of an allocated memory structure can be exploited to execute code in the current user’s context, which may lead to local compromise. Current knowledge indicates that exploitation requires a victim to open a malicious file, so user interaction is a prerequisite.

Affected Systems

Adobe Substance 3D Stager is affected. No specific version information is provided, so any installation of the Stager component should be examined for the vulnerability.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity for this bug. However, the EPSS score is below 1 %, implying a low probability of exploitation in the wild. The vulnerability is currently not listed in CISA’s KEV catalog. Attacks would involve the victim opening a malicious file, making this a user‑interactive vector rather than remote. Nonetheless, the potential impact of code execution warrants proactive mitigation.

Generated by OpenCVE AI on October 16, 2026 at 04:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Adobe Substance 3D Stager to the latest version that addresses the out‑of‑bounds read.
  • Avoid opening unknown or untrusted Substance 3D files; only open files from verified sources.
  • Run Substance 3D Stager in a sandboxed or restricted user environment to limit the effect of any successful exploitation.

Generated by OpenCVE AI on October 16, 2026 at 04:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:*

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe substance 3d Stager
Vendors & Products Adobe
Adobe substance 3d Stager

Wed, 14 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Substance3D - Stager | Out-of-bounds Read (CWE-125)
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Substance 3d Stager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-15T03:56:45.786Z

Reserved: 2026-10-01T11:26:24.768Z

Link: CVE-2026-103840

cve-icon Vulnrichment

Updated: 2026-10-14T18:41:49.414Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T20:17:10.340

Modified: 2026-10-20T00:09:19.227

Link: CVE-2026-103840

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:03:00Z

Weaknesses