CVE-2026-103842: Substance3D - Stager | Out-of-bounds Read (CWE-125)
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Substance3D - Stager are exposed when they open a crafted malicious file. Code execution would occur in the context of the user who opens the file.
What does an attacker need to exploit it?
An attacker needs to provide a crafted file and persuade a victim to open it. The supplied severity vector indicates local attack vector, low attack complexity, no privileges required, and required user interaction.
Does exploitation require a user action?
Yes. The victim must open the malicious file for exploitation to occur.
What is the potential impact if exploitation succeeds?
The out-of-bounds read can be leveraged to execute code as the current user, with high confidentiality, integrity, and availability impact indicated by the supplied severity vector.