CVE-2026-103841

Adobe Substance 3d Stager: out-of-bounds read

Risk score: 48/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.2%
Published: 13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user int…
Affected: Adobe Substance 3d Stager
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Adobe Substance 3d Stager: Yellow, plan it in. Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

The flaws

CVE-2026-103841: Out-of-bounds read (CVSS 7.8 · EPSS 0%)
CVE-2026-103830: Stack buffer overflow can lead to remote code execution (CVSS 7.8 · EPSS 0%)
CVE-2026-103843: Use-after-free can lead to remote code execution (CVSS 7.8 · EPSS 0%)
CVE-2026-103840: Out-of-bounds read (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Adobe Substance 3d Stager

Where it stands

No known exploitation

Connects to

Same weakness: Out-of-bounds read (CWE-125). 347 other warnings in 30 days
Same product: Earlier Adobe Substance 3d Stager warnings. 9 in the last 90 days

Why it is Yellow

CVSS 7.8 high

References

https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html

Original description

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Last activity 13 Oct 2026. Patch Forecast updates every hour.