Description
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

When Substance 3D Stager parses a crafted file it performs an out‑of‑bounds read past the end of an allocated memory region. The read can be leveraged by an attacker to execute arbitrary code in the context of the current user. The primary impact is that code can run with the privileges of the user who opens the malicious file.

Affected Systems

Adobe Substance 3D Stager is the affected product. No specific version information is provided in the entry.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity level. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction: a victim must open a malicious file that contains the crafted payload. The attack vector is likely a file‑based delivery where the user is tricked into launching Stager with a malicious file.

Generated by OpenCVE AI on October 16, 2026 at 04:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Adobe Substance 3D Stager patch or upgrade to the most recent release to remove the out‑of‑bounds read flaw.
  • As an interim measure, restrict the ability of Stager to automatically open unknown files by disabling or removing its file association and limiting file types you allow to be opened.
  • Implement file integrity or antivirus scanning on files destined for Stager to detect malicious content before opening it.

Generated by OpenCVE AI on October 16, 2026 at 04:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:*

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe substance 3d Stager
Vendors & Products Adobe
Adobe substance 3d Stager

Wed, 14 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Substance3D - Stager | Out-of-bounds Read (CWE-125)
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Substance 3d Stager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T10:40:54.818Z

Reserved: 2026-10-01T11:27:51.468Z

Link: CVE-2026-103841

cve-icon Vulnrichment

Updated: 2026-10-14T10:40:26.970Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T20:17:10.453

Modified: 2026-10-20T00:09:32.423

Link: CVE-2026-103841

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:02:47Z

Weaknesses