EUVD-2026-100585
GHSA-3g3w-qvpq-j7c8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D file to victim
-
ExploitVictim opens file in Stager
-
ExecutionTrigger stack buffer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Substance 3D Stager version 3.1.8 or earlier; there is no remote-triggerable network service involved. The limiting factors are mandatory user interaction (UI:R - the user must open the crafted file) and the local attack vector, meaning the attacker must first socially engineer delivery of the file. Code executes only in the context of the current user, so impact is bounded by that user's privileges rather than granting system-level access directly. |
| Impact | This is a genuine but not emergency-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) is a classic client-side file-parsing RCE: although scored as 'local' attack vector, exploitation is realistically remote-assisted because the attacker delivers a malicious scene/asset file that the victim must open, converting network delivery into local execution in the victim's user context. There is NO CISA KEV listing and NO public exploit code identified, and no EPSS score was provided in the input, so there is no evidence of active or imminent mass exploitation - the practical risk is bounded by the required user interaction. The signals are internally consistent (the UI:R metric matches the description's 'victim must open a malicious file' statement), so no contradiction needs vendor verification; the main missing signals are EPSS probability and POC status, which are simply absent rather than conflicting. Net: treat as a routine-to-prompt desktop-application patch for workstations running the affected creative software, not a drop-everything internet-facing emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D project or asset file and delivers it via email, a shared project repository, or a marketplace download. A designer opens the file in Substance 3D Stager, triggering a stack-based buffer overflow during parsing that executes attacker-controlled code with the user's privileges. No public exploit code has been identified, and success depends on the victim opening the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Opening a crafted file in Adobe Substance 3D Stager 3.1.8 or earlier can trigger a stack-based buffer overflow that leads to arbitrary code execution in the context of the current user. The attack is local in nature (AV:L) and requires the victim to open an attacker-supplied file (UI:R), while requiring no privileges on the target (PR:N), so practical exploitation depends on socially engineering a user into opening a malicious asset rather than on any remotely reachable network service. There is no public exploit identified at time of analysis and nothing in the supplied intelligence indicates confirmed active exploitation, so this is a genuine but not emergency-priority issue at a CVSS 3.1 base score of 7.8, with impact bounded by the privileges of the user who opens the file.
RemediationAI
The provided intelligence does not include an exact fixed version number, so no vendor-released patch version can be cited from this data set; consult Adobe security bulletin APSB26-170 (https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html) for the patched build and apply it via the Creative Cloud updater or the Adobe product download page as soon as it is identified, then verify the installed version is above 3.1.8. Until that upgrade is deployed, the most effective controls target the required user interaction: block inbound and web-downloaded Stager project, scene, and asset file types at email and web gateways, and instruct users not to open files from untrusted sources - the trade-off is reduced workflow flexibility for legitimate asset exchange. Restrict the affected application to standard, non-administrative user accounts so that any successful exploitation is contained within that user's privileges rather than yielding elevated access (side effect: some workflows requiring privileged paths may break). Where feasible, run file opening of untrusted assets inside a disposable VM, sandbox, or isolated workstation with no access to sensitive network shares or credential stores, accepting the operational overhead of an isolated environment; note that simply disabling file preview/thumbnail handlers reduces incidental parsing but does not eliminate the need for the user to open the file. Monitor for abnormal child processes spawned by Substance 3D Stager and for unexpected file writes following document opens, as these are practical detection signals for exploitation of this class of bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic memory-safety defect in native file-parsing code, classified as CWE-121 (Stack-based Buffer Overflow), meaning data derived from a malicious file is copied into a fixed-size stack buffer without adequate bounds validation. Like other Adobe Substance 3D applications, Stager handles complex 3D asset and document formats through C/C++ parsing routines, and a malformed field length or oversized element can overwrite adjacent stack memory, including saved control data, allowing an attacker to redirect execution and run code under the user's security context. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms the overflow is not reachable across a network interface, is low in attack complexity once a file is delivered, requires no prior authentication or privileges, and yields high confidentiality, integrity, and availability impact but is scoped only to the vulnerable component rather than the whole system. The affected package set is described by ENISA EUVD (EUVD-2026-100585) as Adobe Substance 3D Stager version 0 through 3.1.8; no official CPE string was supplied in the source data, so product matching should rely on the vendor bulletin and installed-version inventory rather than CPE-based scanning.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user (AV:L, UI:R) with no prior privileges (PR:N); memory-corruption RCE in the user context yields full C/I/A high.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager 3.1.8 and earlier contains a high-severity stack-based buffer overflow that allows arbitrary code execution when a user opens a crafted asset file. The attack is local, requires user interaction, and no public exploit identified at time of analysis, but a successful compromise would run with the victim's privileges and could lead to data theft or lateral movement. Leadership should care because design and creative teams frequently open third-party 3D files, and no vendor-released patch identified at time of analysis, so risk must be managed through interim controls.
No vendor-released patch identified at time of analysis; implement least privilege (remove local admin), application control, EDR monitoring for Stager child processes, user training against opening untrusted files, and sandboxing/VM isolation for untrusted 3D assets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB