EUVD-2026-100596
GHSA-qwf6-8328-9fj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D file to victim
-
ExploitVictim opens file in Substance 3D Stager
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open an attacker-supplied malicious file in Adobe Substance 3D Stager (version 3.1.8 or earlier); it is not remotely triggerable and not automatable. The limiting factors are significant: mandatory user interaction (UI:R), a local attack vector (AV:L) meaning the attacker must get the crafted file in front of a user, and no privilege escalation beyond the current user's context (S:U) - code runs only as the user who opened the file. There is no indication that a special non-default configuration is needed; any installation that can open the malicious file format is exposed. |
| Impact | This is a classic client-side memory-corruption flaw: the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.8 (High), driven by full C/I/A impact from arbitrary code execution, but gated by AV:L and UI:R - the attacker cannot reach the target over the network and must convince a victim to open a malicious file. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is not indicated (absent), so there is no confirmation of active exploitation, and no POC is referenced - meaning there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (local attack vector matches the 'open a malicious file' description), so there is no contradiction to flag. Net assessment: a real but not emergency priority. It is a legitimate High-severity RCE worth prompt patching for workstations that handle untrusted 3D asset files, but the required user interaction and lack of any exploitation/POC evidence place it well below network-reachable, actively-exploited critical flaws. Treat as routine-to-elevated desktop patch management rather than a drop-everything event. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D asset or project file and delivers it to a victim via email, a shared asset library, a download, or a compromised marketplace. When the victim opens the file in Substance 3D Stager (version 3.1.8 or earlier), a malformed structure triggers an out-of-bounds write (CWE-787) that corrupts memory and leads to arbitrary code execution in the victim's user context. No public exploit code or active exploitation is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, and Adobe's PSIRT has published advisory APSB26-170 covering the issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.8 High on the strength of full confidentiality, integrity and availability impact, but the attack is not remotely triggerable: the attacker must deliver a malicious file and convince a victim to open it, and any resulting code runs only with that user's privileges, with no privilege escalation beyond the current user. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); exploitation is neither automatable nor network-reachable, so risk concentrates on targeted file-delivery campaigns against individual Stager users.
RemediationAI
Patch available per vendor advisory: Adobe addresses CVE-2026-103836 in APSB26-170 (https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html); apply the vendor-provided update to Substance 3D Stager and note that the source data does not state an exact fixed version number, so confirm the corrected build from that advisory before closing out. Until the update is applied, the dominant control is reducing exposure to the file-delivery path: block or quarantine Stager project/scene file attachments at the email gateway and web proxy, and prevent untrusted downloads from being opened directly in Stager - the trade-off is added friction for legitimate asset exchange. Because the vector is AV:L/UI:R with S:U, running Stager as a standard, non-administrative user materially limits the consequences of successful exploitation (code executes only as that user), at the cost of restricting the user's ability to install plug-ins or write to protected locations. Opening untrusted 3D assets inside a disposable VM or a sandboxed/converted session is an effective compensating control with the trade-off of reduced performance and GPU feature parity. Application allowlisting that restricts which processes may launch Stager, plus EDR monitoring for Stager spawning unexpected child processes (shells, script interpreters, downloaders), can catch post-exploitation behaviour; these measures add administrative overhead and generate benign false positives during plug-in or scripted workflows. No vendor-released patch version beyond the advisory reference is confirmed in the provided data, and no public exploit code has been identified at time of analysis, so prioritise patching and delivery-path hardening rather than emergency network isolation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (out-of-bounds write), a memory-corruption class in which a parser writes past the bounds of an allocated buffer while processing attacker-controlled input - here, the contents of a 3D scene/project file opened in Adobe Substance 3D Stager, Adobe's 3D scene composition and staging application in the Substance 3D collection. Because the write occurs in the file-parsing path, a memory-safety fault can be turned into controlled corruption of adjacent memory and, under the CVSS assessment, into arbitrary code execution with the current user's rights (C:H/I:H/A:H). The tags accompanying the report - RCE, Buffer Overflow, Memory Corruption - are consistent with this class. The attack surface is local-interactive (AV:L, UI:R): the malicious file must land on the victim's system and be opened in the application, and no non-default configuration is required for an installation that can open the affected file format. EUVD record EUVD-2026-100596 lists the affected vendor version range as Adobe Substance 3D Stager 0 through 3.1.8; no CPE strings were supplied in the source data, so the exact platform bindings (Windows/macOS) cannot be enumerated from the provided material alone.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open RCE: AV:L and UI:R because a user must open a local malicious file, PR:N since no prior auth is needed, and C/I/A:H for arbitrary code execution as the user.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager 3.1.8 and earlier is affected by an out-of-bounds write that can allow a crafted file to run code with the privileges of the user who opens it, putting creative workstations and the data they hold at risk. No public exploit identified at time of analysis, and the flaw requires a user to open a malicious file without privilege escalation or remote spread, so the practical threat is targeted file-delivery against individual Stager users. Security leadership should act on inventory and interim controls now because no vendor-released patch is currently available.
No vendor-released patch identified at time of analysis; interim mitigations include restricting Stager to trusted files, running it with least privilege, application allowlisting, disabling preview handlers for Stager file types, email and web gateway filtering of Stager project files, EDR monitoring, network segmentation for creative workstations, and user awareness. Monitor Adobe advisory APSB26-170 for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB