What is the CVSS score of CVE-2026-27277?

CVE-2026-27277 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Substance 3d Stager are affected by CVE-2026-27277?

Substance3D Stager versions 3.1.7 and earlier contain a critical vulnerability allowing attackers to execute arbitrary code on affected systems if users open malicious files.

How to fix or mitigate CVE-2026-27277?

Within 24 hours: Identify all systems running Substance3D Stager 3.1.7 or earlier and restrict file-opening permissions to trusted sources only. Within 7 days: Disable Substance3D Stager if not operationally critical, or implement application whitelisting for file types accepted by the software. Within 30 days: Monitor Adobe's security advisories for patch availability and prepare deployment; conduct user awareness training on avoiding suspicious file sources.

Substance 3d Stager CVE-2026-27277

HIGH

Use After Free (CWE-416)

2026-03-10 psirt@adobe.com

Use After Free Substance 3d Stager

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 19:17 nvd

HIGH 7.8

DescriptionCVE.org

Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Substance 3D Stager 3.1.7 and earlier through a use-after-free memory vulnerability that triggers when users open specially crafted malicious files. An attacker can exploit this to execute code with the privileges of the affected user, though no patch is currently available to remediate the issue.

Technical ContextAI

Classified as CWE-416 (Use After Free). Affects Substance 3D Stager. Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.