CVE-2026-103840
7.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-125
Impact
An attacker can achieve arbitrary code execution in the context of the logged-in user. To exploit it, they must trick a user into opening a maliciously crafted file.
Root cause
An out-of-bounds read flaw occurs when parsing file contents past the boundary of an allocated buffer.
Affected systems
Adobe Substance 3D Stager; exact version numbers are not listed in the record.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Update Adobe Substance 3D Stager to the patched version detailed in Adobe advisory APSB26-170, and avoid opening untrusted project files until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.