Description
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Patch
AI Analysis

Impact

A stack-based buffer overflow in Adobe Substance 3D Stager allows an attacker to execute arbitrary code under the context of the user who opens a malicious file. The flaw resides in the handling of user‑supplied input and can be triggered by a crafted file, leading to full compromise of the victim’s system if the user processes the file.

Affected Systems

Adobe Substance 3D Stager is affected. No specific product versions are listed in the CNA data.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.8, indicating substantial impact. The EPSS score is below 1 %, suggesting a low likelihood of exploitation, and the vulnerability is not currently listed in CISA KEV. Exploitation requires user interaction: the user must open a malicious file, so the attack vector is local user action.

Generated by OpenCVE AI on October 16, 2026 at 04:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch released by Adobe for Substance 3D Stager as soon as it becomes available.
  • Implement policy controls to prevent users from opening files from untrusted sources or from using file preview without proper safe handling.
  • Deploy endpoint protection that detects and blocks execution of code originating from compromised files to add an additional defensive layer.

Generated by OpenCVE AI on October 16, 2026 at 04:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe substance 3d Stager
Vendors & Products Adobe
Adobe substance 3d Stager

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Substance 3d Stager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-15T03:56:46.482Z

Reserved: 2026-10-01T11:27:51.469Z

Link: CVE-2026-103851

cve-icon Vulnrichment

Updated: 2026-10-14T18:59:23.177Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T20:17:11.510

Modified: 2026-10-15T04:18:13.743

Link: CVE-2026-103851

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:02:58Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow