Loading vulnerability…
Arbitrary Code Execution in Adobe Substance 3D Stager via Out-of-Bounds Write
CVE-2026-103835 is an out-of-bounds write vulnerability in Adobe Substance 3D Stager versions 3.1.8 and earlier on Windows and macOS. Opening a malicious file can trigger memory corruption and allow arbitrary code execution in the current user's security context. The vulnerability is rated High, with a CVSS v3.1 base score of 7.8. The affected function and file format have not been specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability by executing attacker-controlled code with the current user's privileges. The vulnerability does not independently provide elevated privileges beyond that user's security context.
If you can’t patch tonight, do this now.
Until the update is installed, avoid opening untrusted or unexpected files in Substance 3D Stager. This reduces exposure to the required malicious-file interaction but does not correct the vulnerability. No vendor-specific workaround is identified.
Patch, then assume compromise.
Upgrade Adobe Substance 3D Stager to version 3.1.9 or later, which addresses the vulnerability under security bulletin APSB26-170. Install the update through the Creative Cloud desktop application; administrators can deploy updated applications through Adobe Admin Console in managed environments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.