Product:
Substance3D – Stager
Summary
Substance3D – Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file. This could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-21345 |
Exploitation
Exploitation of this issue requires user interaction, as a victim must open a malicious file. Once the file is opened, the out-of-bounds read can be triggered, allowing the attacker to execute arbitrary code within the context of the user running the application.
Affected Products
- Substance3D – Stager versions 3.1.6 and earlier: Vulnerable to out-of-bounds read when parsing crafted files.
Mitigation
To mitigate this vulnerability, users should avoid opening untrusted or unknown files in Substance3D – Stager. Additionally, updating to the latest version of the software, which addresses this vulnerability, is strongly recommended.