Loading vulnerability…
Use-after-free code execution in Adobe Substance 3D Stager
CVE-2026-103843 is a use-after-free vulnerability affecting Adobe Substance 3D Stager 3.1.8 and earlier on Windows and macOS. Opening a malicious file can trigger the vulnerability and allow arbitrary code execution in the current user's security context. The specific vulnerable function has not been identified. The vulnerability is rated High with a CVSS v3.1 base score of 7.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of resources accessible to the current user through arbitrary code execution. The vulnerability does not itself establish execution with privileges beyond those of that user.
If you can’t patch tonight, do this now.
Until the update is installed, avoid opening untrusted or unsolicited files in Substance 3D Stager. No product-specific workaround is identified.
Patch, then assume compromise.
Upgrade Adobe Substance 3D Stager to version 3.1.9 or later, which addresses the vulnerability under security bulletin APSB26-170. Install the update through the Creative Cloud desktop app; administrators can deploy updated applications through Adobe Admin Console.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.