Read the docs
TI-2026-73569 Aliases CVE-2026-103840GHSA-3p26-j28f-8hhh

Substance3D Stager Out-of-Bounds Read Enables Code Execution via Crafted File

Priority LOW 35CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Adobe Substance 3D Stager contains an out-of-bounds read (CWE-125) when it parses a crafted file, which can read past the end of an allocated memory structure. An attacker can use this to execute code in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file. CISA has not added the issue to KEV, and no exploit link appears in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00158 4th percentileScored 2026-11-07
Fix Fixed Adobe Substance 3D Stager (Adobe): 3.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeAdobe Substance 3D Stagerup to 3.1.83.1.9Patch availableCNA
  • Adobe Substance 3D Stager VendorAdobe Affected up to 3.1.8 Fixed in 3.1.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:*up to 3.1.8VulnerableAdobe
  • cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:* Versions up to 3.1.8 Vulnerable ·Adobe

Remediation

Update Adobe Substance 3D Stager to version 3.1.9, which fixes versions from 0 through 3.1.8.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Adobe Substance 3D Stager (Adobe) Fixed in 3.1.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Adobe Substance 3D Stager — adobe.com/trust/security/products/substance3d-stager/apsb26…

    16 records Highest priority Priority LOW 16 LOW

    Other records, highest priority first

    • TI-2026-73579 Stack-based buffer overflow in Adobe Substance 3D StagerPriority LOW 35
    • TI-2026-73572 Use after free in Substance3D Stager allows code executionPriority LOW 35
    • TI-2026-73571 Out-of-bounds read in Adobe Substance 3D StagerPriority LOW 35
    Show all 16 records → Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-103840
  2. 2026-10-13 Alias added: GHSA-3p26-j28f-8hhh
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-15 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-38223 Substance3D - Stager | Integer Underflow (Wrap or Wraparound) (CWE-191) CVSS 3.1HIGH 7.8
  • TI-2025-38222 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-38221 Substance3D - Stager | Out-of-bounds Read (CWE-125) CVSS 3.1HIGH 7.8
  • TI-2025-28266 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-28265 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-28263 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
See all 99 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences