CVE-2026-103842
7.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-125
Impact
Attackers can execute arbitrary code in the context of the local user. Exploitation requires convincing a user to open a crafted, malicious file in the application.
Root cause
An out-of-bounds read error occurs when parsing untrusted input files, reading memory past the allocated buffer.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Substance 3D Stager to the patched version referenced in Adobe bulletin APSB26-170. As an interim workaround, do not open untrusted or unverified project files.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.