EUVD-2026-100592
GHSA-5q33-qhx4-r47g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D asset file to victim
-
ExploitVictim opens file in Substance 3D Stager
-
ExecutionTrigger out-of-bounds write (CWE-787)
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to locally open a crafted/malicious file in Adobe Substance 3D Stager (version 3.1.8 or earlier); this user-interaction requirement (UI:R) and local attack vector (AV:L) are the primary limiting factors. There is no network-facing exposure and no remote trigger - the attacker must get the malicious 3D asset/scene file onto the victim's machine and induce them to open it. Code executes only in the context of the current user, so impact is bounded by that user's privileges rather than conferring system-level access directly. No special non-default configuration is required beyond running a vulnerable version of the product and processing an untrusted file. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local attack vector requiring user interaction - this is a client-side file-parsing flaw, not a remotely-reachable service bug. Although PR:N indicates no prior authentication, UI:R means the attacker cannot act autonomously: a victim must be socially engineered into opening a malicious file. No EPSS score is provided in the input, and the vulnerability is NOT listed in CISA KEV; no public exploit code is referenced. SSVC-style reasoning puts this as low-automatability (requires per-victim file delivery and user action) with total technical impact (full C/I/A) in the current user's context. This is a genuine but non-emergency priority: high impact if triggered, but constrained by the need for user interaction and local file access, with no evidence of active exploitation or public POC. It is a 'patch in normal cycle' issue rather than a drop-everything threat, unless the affected workstations handle untrusted 3D asset files routinely. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D scene/asset file and delivers it to a victim via email, a shared project, or a download, relying on social engineering. When the victim opens the file in Substance 3D Stager, a malformed structure triggers an out-of-bounds write that corrupts memory and executes attacker-controlled code with the privileges of the current user. No public exploit code is identified at time of analysis, and exploitation is bounded by the required user interaction (local open of a crafted file). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when a victim opens a crafted 3D asset or scene file. The flaw is a client-side file-parsing issue (CWE-787) with a local attack vector and required user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8); no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). Attackers must deliver a malicious file to the target and induce the user to open it, which limits exposure to systems where untrusted Stager files are processed.
RemediationAI
Patch available per vendor advisory: Adobe APSB26-170 (https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html) addresses CVE-2026-103834, and affected installations should be upgraded to the latest version referenced in that advisory, since the vulnerable range is 3.1.8 and earlier. Until upgraded, reduce exposure by not opening untrusted or unsolicited Stager scene/asset files and only processing files from trusted sources; consider reviewing suspicious files in a low-privilege or sandboxed environment, and apply email/web download controls that block unexpected 3D asset attachments. Disabling file-association auto-open for Stager project formats and using least-privilege user accounts limit the impact of successful exploitation but do not remove the underlying flaw. Note that the local, user-interaction nature of the attack means perimeter defenses alone are insufficient; user awareness and controlled file-handling are the key compensating controls when immediate patching is not possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying issue is an out-of-bounds write (CWE-787) in the file-parsing components of Adobe Substance 3D Stager, a 3D scene composition and staging application. When the application parses a specially crafted scene or asset file, memory corruption occurs that can be leveraged to execute code with the privileges of the user who opened the file. Because parsing is local and interactive (AV:L, UI:R, PR:N), no network-facing service or authentication step is involved; the risk concentrates on users who routinely open third-party or untrusted Stager project files. Affected version data from EUVD lists Adobe Substance 3D Stager 0 through 3.1.8, and the vendor advisory (apsb26-170) provides the authoritative product scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a victim, so AV:L and UI:R; no prior auth needed (PR:N); out-of-bounds write yields full code execution in user context, so C/I/A all High, scope unchanged.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager 3.1.8 and earlier contain an out-of-bounds write that allows a crafted 3D asset or scene file to execute code with the privileges of the user who opens it. Exposure is concentrated in design, content, and review teams that routinely open Stager files received from external parties, since a single malicious file delivered to one workstation is enough. No vendor patch is available and no public exploit has been identified at time of analysis, so the immediate priority is controlling which files reach users rather than remediating software.
No vendor-released patch identified at time of analysis. Interim mitigations: block or quarantine inbound Stager scene/asset file types at email and web gateways; prohibit opening untrusted or unsolicited Stager files; open untrusted files only inside an isolated VM or sandbox without production network, credential, or share access; run Stager under least-privilege accounts; restrict local admin rights to prevent post-exploitation escalation; add EDR detections for suspicious child processes and unexpected outbound traffic following file opens; monitor Adobe's advisory channel for a fixed release above 3.1.8 and deploy on availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB