Substance 3D Stager CVE-2026-103840

Exploitation requires that a victim running Adobe Substance 3D Stager (version 3.1.8 or earlier) manually open an attacker-supplied crafted file; the flaw is in the file-parsing path, so no vulnerable network service is exposed. Limiting factors: the vector is local (AV:L) with mandatory user interaction (UI:R), meaning the attacker must socially engineer the target into opening the malicious asset and code runs only with the current user's privileges (S:U), not elevated. There is no indication of a non-default configuration requirement - any installation that opens the crafted file type is affected.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) establishes that exploitation is strictly local (AV:L): the attacker cannot reach the flaw over a network but instead relies on a victim opening a crafted file in Substance 3D Stager (UI:R). Although PR:N indicates no prior privileges are needed, the mandatory user interaction and local vector substantially lower real-world risk versus a remotely reachable bug of the same score. No EPSS score, KEV listing, POC reference, or SSVC decision point was provided in the input, so the probability-of-exploitation and automatable signals are simply unknown rather than low - there is no evidence of active exploitation and no evidence ruling it out. Note a tension worth flagging: the input Tags label this 'Information Disclosure', consistent with the CWE-125 out-of-bounds read, yet both the description and the C:H/I:H/A:H impact claim arbitrary code execution; treat the read primitive as a foothold toward code execution rather than a pure disclosure bug. Overall: a legitimate HIGH-severity client-side file-parsing flaw that merits patching in the normal cycle, not emergency-level response absent exploitation evidence.

An attacker crafts a malicious 3D asset or project file and delivers it via email, a download, or a shared model repository. When a victim opens the file in Adobe Substance 3D Stager, the parser reads past the end of an allocated buffer, which the attacker leverages to execute code in the context of the current user. No public exploit code is referenced in the available data.