Read the docs
TI-2026-73566 Aliases CVE-2026-103837GHSA-ppq3-gpw9-94q3

Out-of-bounds write in Adobe Substance 3D Stager

Priority LOW 35CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file. CVSS 3.1 base score is 7.8 (HIGH).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Fix Fixed Adobe Substance 3D Stager (Adobe): 3.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeAdobe Substance 3D Stagerup to 3.1.83.1.9Patch availableCNA
  • Adobe Substance 3D Stager VendorAdobe Affected up to 3.1.8 Fixed in 3.1.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:*up to 3.1.8VulnerableAdobe
  • cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:* Versions up to 3.1.8 Vulnerable ·Adobe

Remediation

Update Adobe Substance 3D Stager to version 3.1.9 or later, which fixes this issue. Affected versions are those before 3.1.9.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Adobe Substance 3D Stager (Adobe) Fixed in 3.1.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Adobe Substance 3D Stager — adobe.com/trust/security/products/substance3d-stager/apsb26…

    16 records Highest priority Priority LOW 16 LOW

    Other records, highest priority first

    • TI-2026-73579 Stack-based buffer overflow in Adobe Substance 3D StagerPriority LOW 35
    • TI-2026-73572 Use after free in Substance3D Stager allows code executionPriority LOW 35
    • TI-2026-73571 Out-of-bounds read in Adobe Substance 3D StagerPriority LOW 35
    Show all 16 records → Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-103837
  2. 2026-10-13 Alias added: GHSA-ppq3-gpw9-94q3
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-15 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-38223 Substance3D - Stager | Integer Underflow (Wrap or Wraparound) (CWE-191) CVSS 3.1HIGH 7.8
  • TI-2025-38222 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-38221 Substance3D - Stager | Out-of-bounds Read (CWE-125) CVSS 3.1HIGH 7.8
  • TI-2025-28266 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-28265 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-28263 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
See all 99 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences