CVE-2026-103840: Substance3D - Stager | Out-of-bounds Read (CWE-125)
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation of this issue?
Users of Adobe Substance 3D Stager are exposed if they open a malicious crafted file. Any resulting code execution would occur in the context of the current user.
What does an attacker need to exploit this vulnerability?
An attacker needs to provide a crafted file and persuade a victim to open it in the affected application. No privileges are required, but user interaction is required.
Does the available information indicate that default configurations are affected?
The available information does not specify configuration-dependent conditions. It identifies crafted-file parsing as the affected attack path.