CVE-2026-103842

Received Received - Intake

Adobe Substance3D Stager Out-of-Bounds Read Vulnerability

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Adobe Systems Incorporated

Description

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103842

EUVD

EUVD-2026-100597

Affected Vendors & Products

Vendor	Product	Version / Range
Adobe	Adobe	Substance 3D Stager 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in Adobe Substance3D Stager. It occurs when the software processes a specially crafted file, causing it to read memory outside its allocated buffer. This flaw could allow an attacker to execute arbitrary code with the same privileges as the user running the application.

Detection Guidance

This vulnerability requires user interaction to exploit, such as opening a malicious file. Detection may involve monitoring for unusual file parsing activities or memory access patterns in Adobe Substance 3D Stager. No specific commands are provided in the available context.

Impact Analysis

If exploited, this vulnerability could let an attacker run malicious code on your system by tricking you into opening a harmful file. This might lead to unauthorized access, data theft, or installation of malware. The impact depends on your system's permissions and the user account's privileges.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution, which may result in data breaches or unauthorized access to sensitive information. Such incidents could impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by exposing personal or protected health information.

Mitigation Strategies

Update Adobe Substance 3D Stager to the latest version as soon as patches are available to address the out-of-bounds read vulnerability.

Hi! I’m here to help you understand CVE-2026-103842. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70