Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-103834

Adobe Substance 3d Stager: out-of-bounds write can lead to remote code execution

Risk score
48/100
CVSS
7.8 v3.1
Exploit chance (30 days)
0.1%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected
Adobe Substance 3d Stager
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Adobe Substance 3d StagerTHE FLAWSTHE FIXCVE-2026-103834Out-of-bounds write can leadto remote code executionCVSS 7.8 · EPSS 0%CVE-2026-103830Stack buffer overflow can leadto remote code executionCVSS 7.8 · EPSS 0%CVE-2026-103843Use-after-free can lead toremote code executionCVSS 7.8 · EPSS 0%CVE-2026-103840Out-of-bounds readCVSS 7.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedAdobe Substance 3d StagerYELLOW · PLAN IT INAdobe Substance3d StagerSubstance3D - Stager isaffected by a Stack-basedBuffer Overflow vulnerabilitythat could result in arbitrarycode execution in the context ofthe current user. Exploitation ofthis issue requires user…Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)258 other warnings in 30 days →Same productEarlier Adobe Substance 3d Stager warnings9 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Adobe Substance 3d Stager: Yellow, plan it in. Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

The flaws

  • CVE-2026-103834: Out-of-bounds write can lead to remote code execution (CVSS 7.8 · EPSS 0%)
  • CVE-2026-103830: Stack buffer overflow can lead to remote code execution (CVSS 7.8 · EPSS 0%)
  • CVE-2026-103843: Use-after-free can lead to remote code execution (CVSS 7.8 · EPSS 0%)
  • CVE-2026-103840: Out-of-bounds read (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Adobe Substance 3d Stager

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.8 high

References

Original description

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Last activity 13 Oct 2026. Patch Forecast updates every hour.