CVE-2026-103841
7.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-125
Impact
Attackers can execute arbitrary code in the context of the logged-in user. This requires convincing a target to open a specially crafted file in Substance3D - Stager.
Root cause
An out-of-bounds read occurs when parsing malicious files, reading past the end of an allocated memory buffer.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Substance3D - Stager to the patched version referenced in Adobe advisory APSB26-170, and avoid opening untrusted project or model files until updated.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.