EUVD-2026-100594
GHSA-ppq3-gpw9-94q3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious 3D asset file to victim
-
ExploitVictim opens file in Substance 3D Stager
-
ExecutionTrigger out-of-bounds write in file parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Substance 3D Stager version 3.1.8 or earlier; per the CVSS vector this is local (AV:L) and needs active user interaction (UI:R) but no pre-existing privileges or authentication (PR:N). The decisive limiting factor is that the attacker cannot trigger the flaw remotely or autonomously - a user must be socially engineered into opening the crafted file - and code execution is confined to the current user's privilege context (S:U), so impact is bounded by that user's rights rather than escalating to system level. |
| Impact | This is a genuine medium-to-high priority patch item but not an emergency. The CVSS 3.1 base score of 7.8 is driven by high confidentiality, integrity, and availability impact (C:H/I:H/A:H) combined with low attack complexity (AC:L) and no privileges required (PR:N). However, the attack vector is Local (AV:L) and requires user interaction (UI:R) - the victim must be socially engineered into opening a malicious file - which meaningfully constrains real-world exploitability versus a remotely-reachable network flaw. Exploitation status: no public exploit identified at time of analysis; the CVE is not listed in CISA KEV and no POC is referenced. No EPSS score was provided in the input, so exploitation probability cannot be quantified. No SSVC decision data was supplied. All signals point to a classic client-side memory-corruption bug in a desktop creative application: dangerous if a user is tricked, but dependent on human action rather than autonomous or wormable exploitation. Net assessment: patch in the normal cycle, prioritizing workstations where untrusted 3D asset files are opened. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Stager project or asset file containing data that triggers the out-of-bounds write, then delivers it via email, a shared asset marketplace, or a compromised download. When a 3D artist opens the file in a vulnerable version (≤3.1.8), the corruption is triggered and arbitrary code executes in the context of the current user. No public exploit code is known at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier permits arbitrary code execution in the context of the current user when a victim opens a crafted file. The flaw is local (AV:L), requires user interaction (UI:R), and needs no privileges (PR:N), so exploitation depends on social engineering rather than remote autonomous triggering. No public exploit or confirmed active exploitation (CISA KEV) is identified at time of analysis, making this a high-priority patch item but not an emergency per the independent assessment.
RemediationAI
Primary remediation: apply the vendor update referenced in Adobe security bulletin APSB26-170; patch availability is per the vendor advisory, but the exact fixed version is not specified in the provided data, so confirm the patched release in the advisory. Because exploitation requires opening a malicious file, reduce exposure by blocking or scanning untrusted .stager and related 3D asset files at email and web gateways, and warn users not to open unsolicited project files. Run Substance 3D Stager with least privilege and consider OS-level sandboxing or AppContainer isolation for untrusted file handling; trade-offs include potential breakage of GPU acceleration, plugins, or file-association workflows. No vendor-released patch version is confirmed in the supplied input beyond the advisory reference.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is CWE-787 (out-of-bounds write) in Adobe Substance 3D Stager's handling of attacker-controlled files. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a local attack that requires the victim to open a malicious file but does not require authentication. Root cause is insufficient bounds validation during file parsing, leading to memory corruption that can corrupt heap or stack structures and hijack control flow. The affected product is identified by EUVD as Adobe Substance 3D Stager 0 ≤3.1.8; no CPE strings were supplied. The vendor advisory is APSB26-170.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitation is file-based and requires the victim to open a malicious file, so AV:L and UI:R; no credentials are needed (PR:N) and arbitrary code runs with full impact in the current user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Substance 3D Stager, a 3D design application used by creative teams, contains a high-severity out-of-bounds write vulnerability that could allow an attacker to execute arbitrary code on a user's system if they open a malicious file. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, but the risk of targeted social engineering attacks could compromise individual workstations and potentially lead to data theft or further network intrusion. Leadership should prioritize mitigation efforts to protect design assets and maintain operational continuity.
User education on avoiding untrusted files, application whitelisting, endpoint detection and response (EDR) monitoring, network segmentation, and running the application with minimal privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB