Loading vulnerability…
NULL Pointer Dereference in Adobe Substance 3D Stager
CVE-2026-103852 is a NULL pointer dereference vulnerability in Adobe Substance 3D Stager 3.1.8 and earlier on Windows and macOS. Opening a malicious file can trigger the vulnerability and crash the application, causing an application-level denial of service. The vulnerability is rated Medium with a CVSS v3.1 base score of 5.5 and vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The specific vulnerable function is not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation crashes Adobe Substance 3D Stager and disrupts application availability. No confidentiality or integrity impact is identified for this vulnerability; arbitrary code execution and memory disclosure associated with other vulnerabilities in the same bulletin do not apply to this CVE.
If you can’t patch tonight, do this now.
Until the update is installed, avoid opening untrusted or suspicious files in Adobe Substance 3D Stager. No vendor-provided workaround is identified.
Patch, then assume compromise.
Upgrade Adobe Substance 3D Stager to version 3.1.9 or later on Windows and macOS. Updates are available through the Creative Cloud desktop app; administrators can deploy the updated application through Adobe Admin Console.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.