EUVD-2026-100471
GHSA-wfcf-53gc-w35q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious 3D asset file
-
DeliveryDeliver file to victim via email or shared repo
-
ExploitVictim opens file in Substance 3D Stager
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim running Adobe Substance 3D Stager version 3.1.8 or earlier be convinced to open a malicious crafted file locally (UI:R, AV:L) - it cannot be triggered remotely or without user action. There is no network-facing attack surface and no authentication is involved (PR:N), but the mandatory user interaction of opening an attacker-supplied file is the primary limiting factor. Code execution is bound to the privileges of the current user (S:U), so impact is constrained to that user's context rather than system-wide. No special non-default configuration is indicated; any installation of the affected versions that opens an untrusted file is exposed. |
| Impact | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local, file-based arbitrary code execution flaw rather than a remotely reachable service vulnerability. Despite PR:N (no privileges), the AV:L vector combined with UI:R means exploitation is not autonomous or wormable - it depends entirely on social engineering a user into opening a malicious crafted file. No EPSS score was provided in the input, so exploitation probability cannot be quantified. This CVE is NOT listed in CISA KEV and no public exploit code was referenced, so exploitation status is 'no public exploit identified at time of analysis.' The high impact triad (C:H/I:H/A:H) justifies the 'High' severity, but the real-world risk is moderated by the mandatory user interaction and the niche, desktop-only deployment of Substance 3D Stager. This is a legitimate patch-worthy issue for organizations running the affected product, but it is not an emergency internet-facing exposure; prioritize it as part of normal client-side/endpoint patching rather than above actively-exploited network vulnerabilities. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D project or asset file that triggers an out-of-bounds write when parsed and delivers it to a victim via email, a shared asset repository, or a download, relying on social engineering. When the victim opens the file in Substance 3D Stager (version 3.1.8 or earlier), the memory corruption is triggered and arbitrary code executes with the privileges of the current user. No public proof-of-concept exploit was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Arbitrary code execution in Adobe Substance 3D Stager 3.1.8 and earlier is achievable when a user is persuaded to open a maliciously crafted file, allowing an unauthenticated attacker to corrupt memory out of bounds and run code in the context of the current user. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local, file-based flaw with no network attack surface, where the mandatory user interaction of opening an untrusted file is the principal limiting factor; impact is confined to the victim user's privileges rather than the whole system. No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
RemediationAI
Patch status is not confirmed from the available data, so the primary action is to consult Adobe's advisory at https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html and upgrade Substance 3D Stager to the build it designates as fixed, since the vulnerability affects versions up to and including 3.1.8 and Adobe advisories of this class normally resolve the issue in a subsequent release; do not rely on an unverified version number. Until that update is applied, the most effective compensating control is procedural isolation of untrusted content: block or quarantine Stager scene, model, and material files received from external parties, since the exploit cannot trigger without a user opening the file (UI:R, AV:L). If untrusted files must be inspected, do so on a workstation running Stager under a dedicated low-privilege OS account with no access to production shares or stored credentials, accepting the trade-off that licensing, cloud asset sync, and user presets may need re-authentication; alternatively, deploy Stager inside an OS application sandbox or disposable VM with no host filesystem mounts, which reduces or blocks the arbitrary-code-execution impact but can degrade GPU acceleration and break plugins or linked asset libraries. Disabling automatic thumbnail/preview generation and file association auto-open reduces accidental triggering but does not prevent a user from manually opening a crafted file, so it should be treated as a secondary hardening measure rather than a substitute for upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is an out-of-bounds write (CWE-787), a memory-corruption defect in which the application writes data past the end of an allocated buffer, typically while parsing a malformed asset file such as a 3D scene, model, or texture container that Substance 3D Stager is designed to import. Because the corruption occurs in the process handling the file, a carefully shaped payload can overwrite adjacent memory structures and redirect execution, which is why the issue is tagged as RCE, Buffer Overflow, and Memory Corruption. The affected technology is Adobe's Substance 3D Stager staging/composition tool itself rather than a network service or library, and the assessed vector (AV:L, UI:R, PR:N) confirms the attack is delivered through local file handling with no authentication step and no remotely reachable interface. ENISA tracks this issue as EUVD-2026-100471 with affected versions reported as Adobe Substance 3D Stager up to and including 3.1.8, and Adobe's product security team (psirt@adobe.com) is credited as the reporter, with the vendor advisory published at apsb26-170.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a victim so AV:L and UI:R; no privileges needed (PR:N); out-of-bounds write yields code execution as current user with full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager 3.1.8 and earlier can be made to run attacker-supplied code in the context of the logged-in user when that user opens a maliciously crafted file, and no vendor patch is currently available to close the gap. Exposure is concentrated in creative and design staff who routinely open third-party 3D assets, whose workstations typically hold design intellectual property and cached credentials. Because exploitation depends on human behaviour rather than a network service, leadership should treat this as a manageable but persistent risk requiring procedural controls until Adobe ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: instruct users not to open untrusted or unsolicited 3D asset files; run Substance 3D Stager with least privilege (no local administrator rights) so any code execution is bounded by the user's privileges; route externally sourced assets through malware scanning or detonation before opening; restrict where asset files can be sourced from; deploy EDR monitoring for anomalous child processes or memory-corruption indicators in the Stager process; and apply the vendor patch immediately once released. Note that no public exploit code identified at time of analysis, and this is not confirmed actively exploited (no CISA KEV entry).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB