Substance 3D Stager CVE-2026-103838

Exploitation requires a victim to open an attacker-supplied malicious file in Adobe Substance 3D Stager version 3.1.8 or earlier; the out-of-bounds write is triggered during file/asset parsing. The primary limiting factors are the local attack vector (AV:L) - the malicious file must reach and be opened on the target workstation - and the mandatory user interaction (UI:R), meaning there is no automatic or remote-without-interaction path. Code executes only at the privilege level of the user running Stager, not SYSTEM/root, which bounds blast radius absent separate privilege escalation.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, file-based attack requiring user interaction, with high impact to confidentiality, integrity, and availability - consistent with a CWE-787 out-of-bounds write yielding arbitrary code execution in the current user's context. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Although PR:N technically means no privileges, the UI:R requirement (victim must open a malicious file) is the dominant limiting factor and makes this a user-driven client-side issue rather than a remotely-triggerable server flaw. Net assessment: a genuinely high-severity memory-corruption RCE for affected users, but real-world urgency is tempered by the local attack vector, mandatory social-engineering step, and the niche deployment of the product - a credible priority for environments running Substance 3D Stager, but not a mass-exploitation emergency on current signals.

An attacker crafts a malicious 3D project or asset file that triggers the out-of-bounds write and distributes it via email, a shared asset library, or a compromised marketplace. A designer opens the file in Substance 3D Stager (version ≤3.1.8), the parser writes past a buffer boundary, and attacker-controlled code executes with that user's privileges. No public POC is identified at time of analysis, so weaponization effort rests with the attacker.