Read the docs
TI-2026-73571 Aliases CVE-2026-103842GHSA-85v7-xg2x-pvvr

Out-of-bounds read in Adobe Substance 3D Stager

Priority LOW 35CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Adobe Substance 3D Stager versions through 3.1.8 contain an out-of-bounds read flaw (CWE-125) when parsing a crafted file. The read goes past the end of an allocated memory structure. An attacker could execute code in the context of the current user if a victim opens a malicious file.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00158 4th percentileScored 2026-11-07
Fix Fixed Adobe Substance 3D Stager (Adobe): 3.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeAdobe Substance 3D Stagerup to 3.1.83.1.9Patch availableCNA
  • Adobe Substance 3D Stager VendorAdobe Affected up to 3.1.8 Fixed in 3.1.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:*up to 3.1.8VulnerableAdobe
  • cpe:2.3:a:adobe:substance_3d_stager:*:*:*:*:*:*:*:* Versions up to 3.1.8 Vulnerable ·Adobe

Remediation

Upgrade Adobe Substance 3D Stager to version 3.1.9, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Adobe Substance 3D Stager (Adobe) Fixed in 3.1.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Adobe Substance 3D Stager — adobe.com/trust/security/products/substance3d-stager/apsb26…

    16 records Highest priority Priority LOW 16 LOW

    Other records, highest priority first

    • TI-2026-73579 Stack-based buffer overflow in Adobe Substance 3D StagerPriority LOW 35
    • TI-2026-73572 Use after free in Substance3D Stager allows code executionPriority LOW 35
    • TI-2026-73570 Out-of-bounds read in Adobe Substance 3D Stager file parsingPriority LOW 35
    Show all 16 records → Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-103842
  2. 2026-10-13 Alias added: GHSA-85v7-xg2x-pvvr
  3. 2026-10-14 CISA SSVC decision points changed
  4. 2026-10-14 Priority changed: MEDIUM → LOW
  5. 2026-10-14 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-38223 Substance3D - Stager | Integer Underflow (Wrap or Wraparound) (CWE-191) CVSS 3.1HIGH 7.8
  • TI-2025-38222 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-38221 Substance3D - Stager | Out-of-bounds Read (CWE-125) CVSS 3.1HIGH 7.8
  • TI-2025-28266 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-28265 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
  • TI-2025-28263 Substance3D - Stager | Use After Free (CWE-416) CVSS 3.1HIGH 7.8
See all 99 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences