EUVD-2026-100591
GHSA-5w47-f44c-7pjr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted 3D file to victim
-
ExploitVictim opens file in Substance 3D Stager
-
ExecutionTrigger out-of-bounds read in file parser
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied crafted file (3D asset/project) in Adobe Substance 3D Stager version 3.1.8 or earlier; the malformed file structure drives the out-of-bounds read during parsing. Key limiting factors per the CVSS vector: the attack vector is local (AV:L) - there is no network-facing or remote trigger - and mandatory user interaction (UI:R) is required, so the attacker must rely on social engineering to get a targeted user to open the file. No authentication or prior privileges are needed (PR:N), and exploitation affects default configurations once a malicious file is opened. Impact is confined to the current user's context (S:U), so running Stager as a non-privileged user limits blast radius. |
| Impact | This is a moderate-priority local vulnerability rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) correctly reflects that exploitation is NOT remote/network-reachable: despite PR:N (no prior privileges), the AV:L and UI:R metrics mean an attacker cannot reach the flaw without first delivering a crafted file and convincing a victim to open it in Substance 3D Stager. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no evidence of active exploitation or automatable mass abuse - this aligns with the client-side, user-interaction-dependent nature of the bug. One signal to note: the underlying weakness is CWE-125 (out-of-bounds READ), yet the input Tags include 'Buffer Overflow' and the description claims code execution; an OOB read most directly yields information disclosure, and achieving full code execution typically requires chaining with other primitives - the vendor-assigned C:H/I:H/A:H impact should be taken as Adobe's assessment rather than independently confirmed. Overall: a genuine issue warranting patching in creative/design environments, but not an internet-facing emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious 3D asset or project file and distributes it via email, a shared asset library, or a download masquerading as legitimate content. When a designer opens the file in Adobe Substance 3D Stager, the malformed structure triggers an out-of-bounds read in the file parser, which Adobe states can be leveraged to execute code in the context of the current user. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Parsing a maliciously crafted 3D asset or project file in Adobe Substance 3D Stager 3.1.8 and earlier can drive an out-of-bounds read that leads to code execution in the context of the user running the application. Exploitation is local and socially engineered - the victim must open the attacker-supplied file (AV:L, UI:R, PR:N) - and impact is confined to that user's privileges (S:U), so a non-administrative account limits the blast radius. No public exploit code and no CISA KEV entry were identified at time of analysis, making this a targeted, per-user risk rather than a mass-exploitation threat.
RemediationAI
Update Adobe Substance 3D Stager to the fixed build documented in Adobe security bulletin APSB26-170 (https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html); the advisory is the authoritative source for the exact patched version, and because no independent fix version is confirmed in the data provided, verify the installed version string against the advisory before closing the finding - this is a vendor-advisory patch rather than a version confirmed in this record. Until the update is applied, treat all untrusted Stager project and asset files as hostile: block 3D/asset attachments at the mail and web gateway and require users to open such files only from vetted internal sources or repositories. Because the vector is local with mandatory user interaction, the highest-value compensating controls are reducing attack surface and blast radius: run Stager under a non-privileged, non-administrative account, since the score's S:U scope means a compromise does not automatically extend beyond that user, and perform any necessary inspection of suspicious files in a disposable VM or sandbox rather than on a production workstation. The trade-offs are reduced workflow convenience and no protection against a user who deliberately opens a file, and no network-facing service or port requires blocking based on this record.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-125, an out-of-bounds read, reached through the code path Stager uses to parse user-supplied 3D content before it is rendered or processed. The parser relies on length and offset fields embedded in the file and reads past the end of an allocated memory buffer; when the out-of-bounds data feeds subsequent pointer or memory operations, the classic information-disclosure primitive can be chained toward memory corruption and arbitrary code execution in the caller's context. Adobe PSIRT is the reporting party, the record is mirrored as EUVD-2026-100591, and community tagging classifies the issue under buffer overflow and information disclosure. Per the affected-version data, the vulnerable range is Adobe Substance 3D Stager 0 through 3.1.8; no CPE strings were supplied with this record, so exact platform/build granularity should be taken from the Adobe advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing flaw triggered only when a user opens a malicious file locally, so AV:L and UI:R; no credentials needed (PR:N); vendor claims full code execution in user context (C/I/A:H, S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager, used by our 3D artists and design teams to build and review textured assets, contains a high-severity file-parsing flaw that allows an attacker-supplied project or asset file to run code under the opening user's account. Because the attack requires a person to deliberately open a crafted file, the realistic exposure is targeted rather than widespread - an emailed or shared 'client asset' is the most plausible delivery path. Leadership should care because the affected population is our creative staff, whose workstations frequently hold licensed content, unreleased product designs, and access to shared asset repositories.
No vendor-released patch identified at time of analysis. Interim mitigations: run Stager under non-administrative accounts to limit the blast radius of code execution; block or sandbox externally sourced 3D asset and project files and require intake via an isolated conversion/validation host; disable default file-type associations so users must consciously open Stager projects; enforce email and file-transfer gateway scanning of 3D formats; restrict Stager hosts' access to shared asset repositories and unreleased design data to least privilege; and enable EDR alerting on anomalous process creation from Stager, with rapid credential rotation and host isolation playbooks if a suspicious file is opened.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB