Loading vulnerability…
Stack-based Buffer Overflow in Adobe Substance 3D Stager
CVE-2026-103830 is a stack-based buffer overflow in Adobe Substance 3D Stager 3.1.8 and earlier on Windows and macOS. Opening a malicious file can trigger the vulnerability and allow arbitrary code execution in the current user's context. The vulnerability is rated High, with a CVSS v3.1 base score of 7.8. The affected function and file format have not been specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability through arbitrary code execution with the privileges of the user running Stager. Attacker-controlled code could access or modify data and disrupt resources accessible to that user; elevated privileges are not inherently granted.
Patch, then assume compromise.
Upgrade Adobe Substance 3D Stager to version 3.1.9 or later on Windows and macOS. Install the update through the Creative Cloud desktop app, or deploy the updated application through Adobe Admin Console in managed environments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.