Adobe Substance 3D Stager CVE-2026-103850

Exploitation requires an attacker to deliver a specially crafted malicious file AND a victim to actively open that file within Adobe Substance 3D Stager (version ≤3.1.8) on the local system - the attack cannot be triggered remotely or without victim action (UI:R, AV:L). The decisive limiting factor is this mandatory user interaction combined with local file delivery: the attacker must first convince the target to obtain and open the malicious asset. No authentication is required on the application itself (PR:N), and impact is confined to confidentiality (memory disclosure) with no code execution or system compromise, further bounding realistic risk.

This is a moderate-severity information-disclosure issue that does not rise to urgent-priority status. The CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a LOCAL attack vector (AV:L) requiring the victim to open a malicious file (UI:R), with impact limited strictly to confidentiality (C:H, I:N, A:N) - there is no code execution, integrity, or availability consequence. The 'High' confidentiality rating stems from potential disclosure of sensitive process memory via the out-of-bounds read (CWE-125). Exploitation status: no public exploit identified at time of analysis - the input contains no CISA KEV listing, no EPSS score, and no POC indicator, so there is no evidence of active exploitation or weaponization. No SSVC decision data was provided. The required user interaction plus local file-delivery dependency substantially lowers real-world risk relative to a network-facing bug: this is better characterized as a high-CVSS-confidentiality metric tempered by a social-engineering precondition and a memory-leak-only outcome, rather than a widely-scannable priority. Note the input Tags include 'Buffer Overflow', which is imprecise: the description and CWE-125 describe an out-of-bounds READ (memory disclosure), not a classic overflow write - treat the 'Buffer Overflow' label with caution.

An attacker crafts a malicious 3D asset or project file and distributes it via email, a download site, or a shared-asset marketplace. A victim opens the file in Adobe Substance 3D Stager (version ≤3.1.8), triggering an out-of-bounds read that leaks adjacent process memory, potentially exposing sensitive in-memory data back to the attacker-controlled file structure. No public exploit code is identified at time of analysis, and the local vector plus mandatory user interaction mean exploitation hinges on successful social engineering.