Adobe Substance 3D Stager CVE-2026-103839

Exploitation requires the victim to open a maliciously crafted file (e.g., a 3D asset or project file) directly in Adobe Substance 3D Stager version 3.1.8 or earlier; there is no remote or network-triggered path. The mandatory user-interaction step (UI:R) and local attack vector (AV:L) are the primary limiting factors, meaning an attacker must rely on social engineering or a trusted-looking asset to be opened. Code execution is confined to the privileges of the current user, so impact is bounded by that account's permissions rather than granting automatic system/root compromise; no special non-default product configuration is described as required.

The CVSS 3.1 base score is 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a local attack vector requiring victim user interaction (opening a malicious file) but no prior privileges, yielding full confidentiality, integrity, and availability impact via arbitrary code execution in the current user's context. This is a classic client-side file-parsing memory-corruption flaw (CWE-787 out-of-bounds write), not a remotely reachable service bug - the 'network-facing' alarm of a 7.8 is tempered by the AV:L/UI:R requirement that a user be socially engineered into opening attacker-controlled content. No EPSS score was provided in the input, and there is no CISA KEV listing or public proof-of-concept referenced, so there is no public exploit identified at time of analysis. SSVC-style reasoning: exploitation is not automatable (requires per-victim user interaction), technical impact is total, but exploitation status is 'none'/'poc-not-present' based on available data. Net: this is a legitimately serious code-execution bug worth patching on normal Adobe Patch-Tuesday cadence, but it is not an emergency drop-everything issue in the absence of any exploitation or POC signal - risk is driven by severity potential, not by observed activity. Key missing data: EPSS probability and any independent exploitation telemetry are absent, so widespread-versus-targeted exploitation cannot be distinguished.

An attacker crafts a malicious 3D asset or project file and delivers it to a victim via email, a download, or a shared asset library. When the victim opens the file in Adobe Substance 3D Stager, a malformed structure triggers an out-of-bounds write that corrupts memory and leads to arbitrary code execution as the logged-in user. No public proof-of-concept is identified at time of analysis, and successful exploitation depends entirely on the victim opening the attacker-supplied file.