CVE-2026-21287

Substance3D - Stager | Use After Free (CWE-416)

Published Jan 13, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Analysis

Technical impact

The vulnerability is a use‑after‑free flaw in Adobe Substance3D – Stager for versions 3.1.5 and earlier. The flaw allows an attacker to execute code in the context of the current user by exploiting a freed memory region. The defect is classified as CWE‑416 and could lead to arbitrary code execution.

Affected Systems

Adobe Substance3D – Stager versions 3.1.5 and earlier are affected. The product is available on macOS and Windows operating systems, as indicated by the associated CPEs.

Risk and Exploitability

The CVSS score of 7.8 indicates moderate to high severity. EPSS is reported as < 1 %, suggesting low current exploitation probability, and the issue is not listed in the CISA KEV catalog. However, the flaw requires the victim to open a malicious file, so it is a user‑interaction dependent attack that remains significant if users are not cautious.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Adobe

Substance3D - Stager

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.1.5
`3.1.6`	unaffected	—

Configuration 1 [-]

AND

cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor	Product	Versions
Adobe	Substance 3d Stager	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the latest Adobe Substance3D – Stager update that fixes the use‑after‑free flaw, as detailed in the Adobe security advisory.
If an update cannot be applied immediately, block or quarantine the existing Substance3D – Stager installation until the patch is available.
Educate users to avoid opening unknown or untrusted files in Substance3D – Stager and verify file signatures before opening.

Generated by OpenCVE AI on April 18, 2026 at 06:32 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://helpx.adobe.com/security/products/substance3d_stager/apsb26-09.html

History

Jan 14, 2026 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jan 14, 2026 7:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Microsoft Microsoft windows
CPEs		cpe:2.3:a:adobe:substance_3d_stager:::::::: cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Apple Apple macos Microsoft Microsoft windows

Jan 14, 2026 11:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe substance 3d Stager
Vendors & Products		Adobe Adobe substance 3d Stager

Jan 13, 2026 8:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title		Substance3D - Stager \| Use After Free (CWE-416)
Weaknesses		CWE-416
References		https://helpx.adobe.com/security/products/substance3d_stager/apsb26-09.html
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`