Product:
Substance3D – Stager
Summary
Substance3D – Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file. This could result in a read past the end of an allocated memory structure, allowing an attacker to execute code in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-21343 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that, when opened by the victim using Substance3D – Stager, triggers the out-of-bounds read. This requires the victim to be tricked into opening the file, which can lead to code execution in the context of the user’s privileges.
Affected Products
- Substance3D – Stager versions 3.1.6 and earlier: Affected by an out-of-bounds read vulnerability that can lead to code execution.
Mitigation
Users are advised to avoid opening untrusted files with Substance3D – Stager until a patch is applied. Adobe is expected to release an update to address this vulnerability, and users should ensure they are using the latest version of the software.