EUVD-2026-100587
GHSA-597g-4cw5-55pc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious 3D asset file
-
DeliveryDeliver file to victim (email/share)
-
ExploitVictim opens file in Stager
-
ExecutionTrigger stack-based buffer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to locally open a maliciously crafted file in Adobe Substance 3D Stager version 3.1.8 or earlier; the malformed input triggers a stack-based buffer overflow (CWE-121) during file parsing. The decisive limiting factor is mandatory user interaction (UI:R) combined with a local attack vector (AV:L) - the attacker cannot trigger this remotely or without a user action, so delivery depends on social engineering (convincing the target to open the file). No special product configuration or enabled feature is required beyond having the vulnerable Stager version installed and opening the file; code runs only with the privileges of the current user (S:U), so a low-privileged victim limits impact to that account. |
| Impact | This is a classic client-side memory-corruption flaw with a moderate-but-real risk profile. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) tells a consistent story: exploitation is LOCAL (AV:L) and hinges on user interaction (UI:R) - a victim must open a malicious file - rather than remote network reachability, so this is not a wormable or mass-exploitable server bug. Although PR:N means no prior authentication is needed, the UI:R requirement effectively gates exploitation behind social engineering. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public POC or exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both agree on local, user-interaction-dependent arbitrary code execution. Net assessment: a legitimately high-severity bug for affected workstations (full C/I/A compromise in the user's context) but one whose real-world priority is tempered by the local attack vector, the mandatory user interaction, and the absence of any exploitation or POC signal. Treat as a standard-priority patch for endpoints running the affected software rather than an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D asset or project file and delivers it to a victim via email, a shared design repository, or a compromised marketplace. When the victim opens the file in Adobe Substance 3D Stager (version ≤3.1.8), a stack-based buffer overflow is triggered, executing arbitrary code in the context of the current user. No public proof-of-concept is referenced, and exploitation requires the local AV:L/UI:R conditions in the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Arbitrary code execution in Adobe Substance 3D Stager (versions 3.1.8 and earlier) is possible when a victim opens a maliciously crafted file, which overflows a stack buffer during parsing and lets the malformed input corrupt memory in the context of the current user. The attack cannot be triggered remotely or without the target's cooperation - it is a local vector (AV:L) that requires user interaction (UI:R), so delivery depends on social engineering that convinces the victim to open the file - and code executes with the privileges of that user only (S:U), meaning a non-administrative victim limits the blast radius to that account. Adobe's PSIRT assigned a 7.8 base score (CWE-121), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
RemediationAI
Apply the fixed build published by Adobe for this issue - see advisory APSB26-170 at https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html, which is the authoritative source for the exact patched version (no exact fix version is present in the available data, so do not rely on an assumed build number); Adobe Creative Cloud customers can update through the Creative Cloud desktop app, and enterprise deployments should push the update via their software distribution tooling. Until patched, compensating controls: instruct users not to open Stager/scene project files from untrusted or unsolicited sources, screening inbound file attachments and downloads at the email and web gateway - trade-off is reduced productivity for legitimate file exchange and imperfect coverage of files arriving via chat, cloud shares or USB media; run Stager as a non-administrative, standard user account so any code execution inherits only low privileges - trade-off is that the flaw remains exploitable, it merely caps impact on that host; and consider detonating untrusted project files in a disposable VM or sandboxed workstation - trade-off is workflow overhead and the need to maintain isolated render environments. There is no configuration toggle that disables the vulnerable file-parsing path, so EDR/application allowlisting can only detect or constrain post-exploitation behaviour (e.g. unexpected child processes or network egress from Stager) rather than prevent the overflow itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-121) in Adobe Substance 3D Stager, a 3D scene staging and rendering application that parses project/scene files authored in the Substance 3D pipeline. During parsing of a supplied file, data is written into a fixed-length buffer allocated on the call stack without adequate bounds checking; the oversized write corrupts adjacent stack memory, including saved frame pointers and return addresses, which is the mechanism by which an attacker can redirect execution to attacker-controlled code. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the trigger is local to the machine, requires no privileges (PR:N - authentication requirements are therefore unauthenticated per the vector, though the real gate is the human action of opening the file), needs a user to open the crafted document (UI:R), and yields unchanged scope but high confidentiality, integrity and availability impact within the victim's user context. Adobe's advisory is tracked as APSB26-170; EUVD records the affected range as Adobe Substance 3D Stager 0 through 3.1.8. No CPE strings were supplied, so product identification should be based on the vendor advisory and the EUVD version range rather than enumerated CPE entries.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally so AV:L and UI:R; no prior auth needed (PR:N); successful overflow yields full code execution in the user's context, giving C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager (versions 3.1.8 and earlier) contains a high-severity arbitrary code execution vulnerability that activates when a user opens a maliciously crafted file. No public exploit code has been identified at time of analysis, but because no vendor patch is available, the risk is elevated for creative teams. The attack requires local user interaction and social engineering, so the primary organizational impact is potential compromise of individual user accounts and the data they can access.
No vendor-released patch identified at time of analysis. Interim mitigations include user awareness training to avoid opening untrusted files, application allowlisting to prevent unexpected child process execution, running Stager with least-privilege accounts, and sandboxing or isolating the application to limit the blast radius of a successful exploit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB