Description
Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

A NULL Pointer Dereference flaw exists in Adobe Substance 3D Stager, allowing a malicious file to cause the application to crash. When the crash occurs, the application becomes unavailable, preventing users from accessing the software until it is restarted. The flaw does not provide additional privileges or compromise confidentiality; it solely disrupts availability.

Affected Systems

Adobe Substance 3D Stager is the affected product. No specific version range is listed in the advisory, so all deployments using this software are considered vulnerable until a patch is installed.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity impact, while the EPSS score of less than 1% signals a low likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Exploitation requires user interaction—the victim must open a crafted file—making it a local, user‑initiated attack. Because the impact is limited to an application crash, the overall risk, while noteworthy for business continuity, is constrained by the necessity of file exposure.

Generated by OpenCVE AI on October 16, 2026 at 04:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Adobe patch available from the Substance 3D Stager security advisory
  • Educate users to avoid opening untrusted or unfamiliar files
  • Configure the environment to enforce automatic security updates and restrict file types that can launch the application

Generated by OpenCVE AI on October 16, 2026 at 04:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe substance 3d Stager
Vendors & Products Adobe
Adobe substance 3d Stager

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Substance3D - Stager | NULL Pointer Dereference (CWE-476)
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Adobe Substance 3d Stager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-15T15:10:53.916Z

Reserved: 2026-10-01T11:27:51.469Z

Link: CVE-2026-103852

cve-icon Vulnrichment

Updated: 2026-10-14T16:11:43.183Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T20:17:11.793

Modified: 2026-10-15T16:17:32.690

Link: CVE-2026-103852

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:02:28Z

Weaknesses