Loading vulnerability…
Out-of-bounds Read Leading to Code Execution in Adobe Substance 3D Stager
CVE-2026-103840 is an out-of-bounds read vulnerability in Adobe Substance 3D Stager 3.1.8 and earlier on Windows and macOS. Parsing a crafted file can cause the application to read beyond the end of an allocated memory structure, potentially allowing arbitrary code execution in the current user's context. Exploitation requires the victim to open a malicious file. The vulnerability is rated High with a CVSS v3.1 base score of 7.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can execute arbitrary code with the privileges of the user running Substance 3D Stager, potentially compromising the confidentiality, integrity, and availability of resources accessible to that user.
If you can’t patch tonight, do this now.
Until the update is installed, avoid opening untrusted or unsolicited files in Substance 3D Stager. This reduces exposure to the required malicious-file interaction but does not correct the vulnerability. No vulnerability-specific vendor workaround is identified.
Patch, then assume compromise.
Upgrade Adobe Substance 3D Stager to version 3.1.9 or later on Windows and macOS. Install the update through the Creative Cloud desktop application; administrators can deploy the updated application through Adobe Admin Console in managed environments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.