Loading vulnerability…
Arbitrary Code Execution via Out-of-Bounds Write in Adobe Substance 3D Stager
CVE-2026-103832 is an out-of-bounds write vulnerability in Adobe Substance 3D Stager 3.1.8 and earlier on Windows and macOS. Opening a malicious file can trigger memory corruption and allow arbitrary code execution in the current user's security context. Exploitation requires user interaction. The vulnerability is rated High, with a CVSS v3.1 base score of 7.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of resources accessible to the current user. Attacker-controlled code runs with that user's privileges; elevated privileges are not an inherent outcome.
If you can’t patch tonight, do this now.
Until the update is deployed, avoid opening untrusted or unexpected files in Adobe Substance 3D Stager. No vendor-approved workaround is specified.
Patch, then assume compromise.
Upgrade Adobe Substance 3D Stager to version 3.1.9 or later, which addresses the vulnerability under Adobe security bulletin APSB26-170. Install updates through the Creative Cloud desktop app, or deploy the updated application through Adobe Admin Console in managed environments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.