EUVD-2026-100593
GHSA-77q2-g669-32jm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D file to victim
-
ExploitVictim opens file in Stager
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Substance 3D Stager version 3.1.8 or earlier; there is no remote network-triggered path (AV:L). The limiting factor is mandatory user interaction (UI:R) - a user must be socially engineered into opening the crafted 3D project/asset file - which significantly constrains large-scale or automated exploitation. No special privileges or authentication are needed (PR:N), and the resulting code executes only in the context of the current user, not with elevated rights. |
| Impact | This is a moderate-priority, not emergency, vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) describes a local attack vector requiring user interaction - the victim must open a malicious file - which is consistent with the description and caps the base score at 7.8 (High) rather than Critical, despite full C:H/I:H/A:H impact. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input: exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of KEV and the local, user-interaction-gated vector argue against widespread automated exploitation; realistic risk hinges on social-engineering a specific user into opening a crafted scene/asset file. Note that PR:N (no privileges) combined with AV:L and UI:R means the attacker needs no account but does need victim cooperation - this is a client-side file-parsing bug, so treat it like a malicious-document threat rather than a remotely reachable service flaw. Prioritize patching for users who routinely open third-party 3D asset files. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D project or asset file that triggers an out-of-bounds write in Substance 3D Stager's file parser and delivers it via email, a shared asset marketplace, or a compromised collaborator. When the victim opens the file in a vulnerable version (≤3.1.8), the memory corruption is leveraged to execute arbitrary code in the victim's user context. No public exploit code was identified in the provided data, so exploitation currently requires original weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted 3D project or asset file. The attack is local in nature (AV:L) and depends entirely on user interaction (UI:R) - the victim must be socially engineered into opening the malicious file - and the resulting code runs with the victim's own privileges rather than elevated rights (no privileges are required per PR:N). At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, so this is assessed as a moderate-priority, not emergency, memory-corruption flaw whose primary risk is targeted, file-based social engineering against individual Substance 3D Stager workstations.
RemediationAI
Patch status is not independently confirmed in the provided data, so treat the Adobe security bulletin apsb26-170 (https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html) as the authoritative source and apply the vendor-designated fixed build as soon as it is published; do not rely on an assumed version number. Until a confirmed patch is installed, the decisive control is blocking the delivery path, because exploitation requires the user to open a malicious file: restrict or prohibit opening Stager project and asset files received from external or untrusted sources (email attachments, chat transfers, shared drives, downloads), and configure mail gateways and endpoint content filters to quarantine or strip Stager-associated project/asset extensions arriving from outside the organization. Where the workflow permits, process unknown assets in a disposable, non-networked VM or sandbox account with no access to production shares or credentials - the trade-off is reduced productivity and the need to move files in and out manually, and note that a shared clipboard or mounted host folder can re-open the path to the host. Running Stager under a dedicated low-privilege local account limits the blast radius of the current-user code execution but does not prevent exploitation, and application allowlisting or removing the product from machines that do not need it eliminates exposure at the cost of lost functionality. Finally, alert EDR on Stager spawning child processes such as command shells, script interpreters or document readers, which is a strong post-exploitation indicator for this flaw class.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write, which falls into the memory-corruption class flagged by the contributing tags (RCE, Buffer Overflow, Memory Corruption). Adobe's Substance 3D Stager is a desktop 3D scene composition and staging application that parses a range of project, mesh, material and texture asset formats; a malformed file causes the parser to write past the end of an allocated buffer, which can corrupt adjacent memory and be shaped into controlled code execution within the process. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects this file-open attack model precisely: the vector is local rather than network (AV:L), complexity is low, no authentication or privileges are needed (PR:N), but a user must actively open the weaponized file (UI:R), and a successful exploit yields high confidentiality, integrity and availability impact only within the current user's security scope (S:U). Reported through Adobe's PSIRT (psirt@adobe.com) and tracked in the EUVD as EUVD-2026-100593, this is a coordinated vendor-disclosed memory-safety defect rather than a remotely reachable network service flaw.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector (AV:L, UI:R) with no privileges required (PR:N); out-of-bounds write yielding code execution gives full C:H/I:H/A:H within the user's context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager 3.1.8 and earlier contains an out-of-bounds write that can allow a crafted 3D project or asset file to run code on the workstation of whoever opens it. Exploitation is local and requires a user to be socially engineered into opening a malicious file, so exposure is concentrated among 3D artists, designers, and content reviewers rather than servers or privileged infrastructure, and the resulting code runs only with the victim's own rights. Leadership should care because no vendor-released patch has been identified, meaning the primary defense today is user awareness and file-handling discipline on creative workstations that often hold sensitive design assets and credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: prohibit opening Stager project and asset files from untrusted or unsolicited sources; block or quarantine 3D asset attachments at email and file-sharing gateways; enforce least privilege, host firewalls, and application allowlisting on Stager workstations; deploy EDR monitoring for anomalous child processes and outbound connections from Stager; segment creative endpoints from sensitive systems; maintain offline backups and monitor vendor advisories for a fixed release and upgrade as soon as one is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB