EUVD-2026-100584
GHSA-5v66-qprq-f6wq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D file to victim
-
DeliveryVictim opens file in Stager
-
ExploitTrigger use-after-free in parser
-
ExecutionExecute arbitrary code as current user
-
ImpactCompromise user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Substance 3D Stager version 3.1.8 or earlier; there is no remote or network trigger (AV:L). The key limiting factors are mandatory user interaction (UI:R) - the file must be actively opened by the user - and local delivery, meaning the attacker depends on social engineering or a trusted asset-sharing channel to get the file in front of a victim. Code execution is confined to the privileges of the current user, so a non-privileged user account limits downstream impact. |
| Impact | This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 High) is driven by HIGH confidentiality, integrity, and availability impact, but the LOCAL attack vector (AV:L) and REQUIRED user interaction (UI:R) significantly constrain real-world exploitability - an attacker cannot reach this remotely and must convince a victim to open a malicious file. PR:N indicates no pre-existing authentication is needed, but that is offset by the social-engineering dependency. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or at-scale exploitation. SSVC-style reading: exploitation status is 'none observed', the flaw is NOT automatable (requires human to open a file), and technical impact is 'total' (code execution as the current user). Net: a legitimate patch-worthy memory-corruption bug in a niche creative-software product, but it behaves like a targeted client-side issue rather than a mass-exploitation threat. No conflicting signals in the data itself; the main gap is the absence of EPSS/POC telemetry. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D project or asset file and delivers it to a designer via email, a shared asset library, or a download, relying on social engineering. When the victim opens the file in Substance 3D Stager (version 3.1.8 or earlier), a use-after-free condition is triggered during parsing, allowing arbitrary code execution in the context of the current user. No public exploit code has been identified at time of analysis, and the local vector with mandatory user interaction limits this to one-victim-at-a-time client-side attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Arbitrary code execution is possible in Adobe Substance 3D Stager 3.1.8 and earlier, where a use-after-free (CWE-416) is triggered while the application processes a crafted file. The CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) shows no authentication is required, but the attacker must deliver the malicious file locally and convince the victim to open it, after which code runs only with the privileges of the current user. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the practical risk is driven by social-engineering delivery and by the fact that a crash (denial of service) is also achievable from the same corrupting file.
RemediationAI
Primary fix: upgrade Adobe Substance 3D Stager to the patched release listed in Adobe security bulletin APSB26-170 (https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html) - any version above the affected 3.1.8 ceiling resolves the issue; the provided data does not name an exact fixed build number, so read the bulletin's build table before confirming. Patch status: consult the vendor advisory, as no exact fixed version is given in the supplied data and no vendor-released patch identifier could be independently confirmed here. If immediate patching is not possible, the following compensating controls reduce exposure with known trade-offs: treat untrusted Substance 3D Stager project and imported-asset files as executable content and block them at email gateways and web download filters (side effect: legitimate asset sharing with external partners breaks and needs an out-of-band channel); restrict who can open externally sourced .stager and related 3D asset files, requiring user confirmation of file provenance for creative staff; run Stager on a least-privileged, non-administrator account so successful exploitation stays inside a low-value user context (side effect: some plugins and license activation may require elevated setup); and open untrusted assets inside a disposable, network-isolated VM or sandboxed workstation image rather than a production machine (side effect: GPU and large-asset performance overhead, and manual effort per file). Because the same corruption primitive can also crash the application, defenders should not treat absence of code-execution telemetry as absence of exploitation - monitor for repeated Stager process crashes followed by child-process creation, and keep EDR memory-corruption detections enabled on creative workstations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Adobe Substance 3D Stager, a 3D scene assembly and staging tool that parses a variety of project and imported asset formats. The root-cause class is memory lifetime mismanagement: a heap object is released while a reference to it is still reachable, and the subsequent dereference operates on memory that may have been reallocated by the attacker's controlled data - the classic path from memory corruption to arbitrary code execution, and also a reliable route to a crash if the corrupted pointer cannot be steered. Adobe's bulletin tags the issue as code execution, denial of service, use-after-free and memory corruption, indicating the same primitive supports both outcomes. No CPE strings were supplied with this record; the affected product identity comes from the EUVD data entry (Adobe Substance 3D Stager 0 through 3.1.8, EUVD-2026-100584) and the vendor advisory apsb26-170. Because exploitation is confined to parsing a local file and the resulting code runs in the user's context, the primary security boundary crossed is the application sandbox rather than the operating-system privilege boundary.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open attack (AV:L) needing no prior auth (PR:N) but mandatory victim interaction (UI:R); use-after-free yields full code execution, so C/I/A all High.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
A high-severity memory corruption flaw in Adobe Substance 3D Stager (3.1.8 and earlier) allows arbitrary code execution when a user opens a maliciously crafted file, potentially compromising the workstation of any designer, artist, or content creator running the tool. Because no vendor patch is currently available, the exposure persists across affected teams and depends on user diligence to avoid opening untrusted project files, which makes it a manageable but real risk to endpoint integrity and any sensitive data accessible to those users.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce user awareness against opening untrusted Stager project files, restrict inbound file delivery channels, run affected endpoints with least privilege, maintain current endpoint detection and response coverage to catch exploitation or crash indicators, and apply any vendor-published workarounds while awaiting a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB