What is the CVSS score of CVE-2026-21344?

CVE-2026-21344 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Substance 3d Stager are affected by CVE-2026-21344?

Substance3D Stager versions 3.1.6 and earlier contain a critical memory parsing vulnerability that could allow attackers to crash the application or potentially execute unauthorized actions through…

How to fix or mitigate CVE-2026-21344?

Within 24 hours: Identify all instances of Substance3D Stager in use and document affected versions. Within 7 days: Implement file input restrictions, restrict file upload sources to trusted channels, and disable auto-file processing features where possible. Within 30 days: Establish communication with Adobe for patch timeline, consider upgrading to version 3.2.0 or later when available, and conduct security awareness training on suspicious file handling.

Substance 3d Stager CVE-2026-21344

HIGH

Out-of-bounds Read (CWE-125)

2026-02-10 psirt@adobe.com

Buffer Overflow Information Disclosure Substance 3d Stager

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 19:15 nvd

HIGH 7.8

DescriptionCVE.org

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Substance 3D Stager 3.1.6 and earlier contains an out-of-bounds read vulnerability in file parsing that allows arbitrary code execution when a victim opens a malicious crafted file. The vulnerability affects local users and requires user interaction to exploit, making social engineering a viable attack vector. No patch is currently available for this high-severity flaw.

Technical ContextAI

Classified as CWE-125 (Out-of-bounds Read). Affects Substance 3D Stager. Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.