EUVD-2026-100472
GHSA-cx5v-66j6-c27v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious 3D asset file
-
DeliveryDeliver file to victim via social engineering
-
ExploitVictim opens file in Substance 3D Stager
-
ExecutionTrigger NULL pointer dereference in parser
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Substance 3D Stager version 3.1.8 or earlier; this mandatory user interaction (UI:R) and local file-handling vector (AV:L) are the primary limiting factors. There is no remote, unauthenticated, or automatable path - the attacker cannot trigger the crash without a user action, and the malicious file must be delivered and opened by the target. No special product configuration is required beyond running an affected version, but impact is confined to an application crash (availability only). |
| Impact | This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, low-complexity attack requiring no privileges but mandatory user interaction, with impact limited exclusively to availability (C:N/I:N) - a CWE-476 NULL pointer dereference that crashes the application. There is no EPSS score, no CISA KEV listing, and no public POC provided in the input, so all three exploitation-probability signals are either absent or negative: no public exploit identified at time of analysis. No SSVC decision data was supplied. The only real-world consequence is an application crash of a desktop 3D authoring tool - there is no code execution, no data exposure, and no lateral movement potential. Note a minor framing nuance: CVSS marks this AV:L (local) yet the realistic delivery is a maliciously crafted file the victim opens, which is a local-file vector rather than a remote network one - consistent with AV:L, not a conflict. Overall this is a genuinely low-risk DoS, not a high-CVSS-but-hidden-critical issue; it rates as routine patch-on-cycle rather than emergency remediation. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D project or asset file and delivers it to a victim (e.g., via email, download, or a shared asset library). When the victim opens the file in Adobe Substance 3D Stager, a NULL pointer dereference is triggered and the application crashes, producing a denial-of-service. No public exploit code is identified at time of analysis, and the impact is limited to the crashed application with no code execution or data loss. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Opening a crafted file in Adobe Substance 3D Stager version 3.1.8 and earlier can trigger a NULL pointer dereference that crashes the application, resulting in a local denial-of-service condition. The issue is not remotely or automatically exploitable: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) requires the victim to open an attacker-supplied file, and the impact is confined to availability with no loss of confidentiality or integrity, giving a base score of 5.5. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the CVE is not listed in CISA KEV; in practice this is a moderate-severity, low-priority issue that matters mainly where untrusted project or asset files are routinely opened.
RemediationAI
The primary fix is to update Adobe Substance 3D Stager to the patched build identified in Adobe Security Bulletin APSB26-170 (https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html); the input data does not specify an exact fixed version number, so confirm the corrected release directly against the vendor bulletin before declaring remediation complete. Where immediate upgrading is not possible, the most effective compensating control is to treat Stager as an untrusted-input application: open only project and asset files from trusted, internally vetted sources, and route externally received files through a malware/format-validation scan before they reach the desktop. Additional hardening that reduces exposure includes running Stager under a low-privilege account or in a sandboxed/containerized workspace so a crash cannot affect other workloads, and monitoring endpoint crash telemetry for repeated Stager faults as an early indicator of malicious files in circulation. Note the trade-offs: file-scanning gates add latency to creative workflows and can block legitimate customer-supplied assets, while sandboxing or least-privilege execution may break GPU acceleration, plugin, and license-activation features. Because impact is limited to a local application crash with mandatory user interaction, organizations may reasonably deprioritize emergency change windows in favor of the next scheduled patch cycle, provided untrusted-file handling is restricted in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-476, a NULL pointer dereference, in the file-parsing path of Adobe Substance 3D Stager, a desktop application used for staging and compositing 3D scenes. When the application processes a malformed input file it reaches a code path where a pointer expected to reference a valid object has not been initialized or has been set to NULL, and the subsequent dereference causes an access violation that terminates the process. Because the flaw lives in local file handling rather than in a network-facing service, the attack surface is limited to whatever files a user chooses to open; per EUVD the affected range is Adobe Substance 3D Stager 0 through 3.1.8. No CPE identifiers were supplied with the source data, so exact platform-level product mapping should be taken from the vendor advisory at https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html, which is also mirrored from the NVD entry for CVE-2026-103852 (EUVD-2026-100472). The CVSS vector's AV:L and UI:R components, combined with PR:N, mean an unauthenticated attacker can only reach the vulnerable code by getting the target to open a malicious file from a local or delivered location; there is no unauthenticated network path.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AV:L and UI:R because exploitation requires a victim to locally open a malicious file; PR:N since no auth is needed; C:N/I:N/A:H as a NULL deref yields crash-only availability loss.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB