EUVD-2026-100595
GHSA-wgxq-vfwc-hh27
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D asset file
-
DeliveryVictim opens file in Stager
-
ExploitTrigger out-of-bounds write in parser
-
ExecutionCorrupt memory and hijack control flow
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a malicious file (3D project/asset) in Adobe Substance 3D Stager version 3.1.8 or earlier; there is no network-facing attack surface. Limiting factors: mandatory user interaction (UI:R) to open attacker-supplied content, local-only vector (AV:L) with no remote trigger, and the fact that code runs only in the context of the current user (S:U, no privilege escalation), so impact is bounded by that user's rights. No special product configuration or feature toggle is named as a prerequisite - the parsing path is reached by default when opening a file, but delivery still depends on social engineering. |
| Impact | This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U) is internally consistent with the description: exploitation is LOCAL (AV:L) and hinges on a victim opening a malicious file (UI:R), not on any network-reachable service, so the 7.8 'High' score is driven by the full C:H/I:H/A:H impact of arbitrary code execution rather than by ease of remote reach. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at the time of analysis and no evidence of active or widespread exploitation. There is no SSVC decision data supplied. The realistic risk is therefore social-engineering dependent: an attacker must deliver a malicious Substance 3D asset and persuade a user to open it. No signals conflict - the description (local, file-open) and the CVSS vector (AV:L, UI:R) agree. Net assessment: a credible code-execution bug worth patching on a normal cycle, but absent EPSS/KEV/POC data it does not indicate opportunistic mass exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D project or asset file that triggers the out-of-bounds write (CWE-787) when parsed by Substance 3D Stager, then delivers it via email, a shared asset library, or a compromised marketplace download. When a designer opens the file, the memory corruption is leveraged to execute arbitrary code in the context of that user. No public exploit code is known at the time of analysis, so this scenario is inferred from the vulnerability class and CVSS vector rather than a demonstrated exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when the victim opens a maliciously crafted 3D project or asset file. The attack path is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), with no network-facing trigger and no privilege escalation beyond the rights of the user who opens the file. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but not emergency-grade priority, where the practical risk is driven by social engineering that convinces a Stager user to open attacker-supplied content.
RemediationAI
Update Adobe Substance 3D Stager to the fixed build published in Adobe's advisory APSB26-170 (https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html); the provided intelligence does not include an exact patched version number, so the advisory should be consulted for the precise fixed release rather than assuming a version. Until the update is applied, treat all 3D project and asset files from external sources as untrusted: since exploitation requires the victim to open a malicious file (AV:L, UI:R) and grants only the rights of the current user (S:U, no privilege escalation), the most effective controls are preventing delivery and opening of untrusted content, and running Stager under a low-privilege, non-administrative account so that any code execution is contained. Additional compensating controls with their trade-offs include: blocking or quarantining inbound .stager and related 3D asset attachments at the email/web gateway (side effect: legitimate asset sharing is disrupted), scanning incoming asset files with endpoint protection before opening (side effect: detection coverage for file-format memory corruption is imperfect and may miss novel payloads), and enabling OS-level exploit mitigations such as ASLR and DEP along with application sandboxing or a virtualized staging environment (side effect: mitigations raise exploitation difficulty but do not remove the bug, and virtualization adds workflow overhead). Note that no public exploit was identified at time of analysis and no active exploitation is confirmed, so prioritization can follow standard risk-based patching rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (out-of-bounds write), a memory-corruption class in which data is written past the end of a heap or stack buffer during parsing of a crafted file. Adobe Substance 3D Stager is a desktop 3D scene staging and layout tool, and this flaw is reached through its default file-parsing path when a user opens a malicious 3D project or asset, meaning the corruption occurs in the content-loading code rather than over a network service. The assessed vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms a local trigger requiring the victim to open the file, with no authentication prerequisite and no scope change, so successful exploitation yields code execution with the integrity and confidentiality impact bounded to the current user's privileges. This matches the reporter's characterization (Adobe PSIRT) and the ENISA EUVD entry EUVD-2026-100595, which classifies the affected release line as Substance 3D Stager 0 through 3.1.8 and tags the issue as RCE, buffer overflow, and memory corruption.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user so AV:L and UI:R; no prior privileges needed (PR:N); out-of-bounds write yields full code execution as the user, hence C:H/I:H/A:H and S:U.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager versions 3.1.8 and earlier contain an out-of-bounds write vulnerability that allows arbitrary code execution when a user opens a maliciously crafted 3D project or asset file. This local attack requires user interaction and poses a risk to creative workstations, potentially enabling data theft or lateral movement within the user's privileges. No public exploit identified at time of analysis, but leadership should prioritize mitigation because design teams often handle valuable intellectual property and may be targeted via social engineering.
No vendor-released patch identified at time of analysis. Interim mitigations include: user awareness training to avoid opening untrusted 3D files, application sandboxing or EDR rules to restrict Stager's ability to execute arbitrary code, least-privilege user accounts, email/web gateway filtering of 3D file attachments, and disabling file preview handlers for 3D formats where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB