CVE-2026-103843

Received Received - Intake

Use After Free in Adobe Substance3D Stager

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Adobe Systems Incorporated

Description

Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103843

EUVD

EUVD-2026-100584

Affected Vendors & Products

Vendor	Product	Version / Range
Adobe	Adobe	Substance 3D Stager 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

Substance3D Stager has a Use After Free vulnerability that allows arbitrary code execution when a user opens a malicious file. This occurs because the program improperly manages memory after freeing it, potentially letting attackers execute malicious code with the same privileges as the current user.

Detection Guidance

Detection of this vulnerability requires monitoring for suspicious activity when opening files in Adobe Substance 3D Stager. Check for crashes or unexpected behavior when processing files. Enable application logging to track file operations and user interactions.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on your system, potentially leading to data theft, system damage, or unauthorized access. Since exploitation requires opening a malicious file, users should avoid downloading or opening untrusted files.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) or HIPAA (health data privacy) if sensitive information is compromised. Organizations using Substance3D Stager should apply patches promptly to maintain compliance.

Mitigation Strategies

Immediately update Adobe Substance 3D Stager to the latest patched version. Avoid opening untrusted or suspicious files. Implement application allowlisting to restrict execution of unauthorized software. Monitor Adobe security advisories for further updates.

Hi! I’m here to help you understand CVE-2026-103843. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70