Adobe Substance 3D Stager: Use-after-free vulnerability allows code execution
Summary
Adobe Substance 3D Stager versions 3.1.8 and earlier on Windows and macOS contain a use-after-free vulnerability (CWE-416). An attacker can execute arbitrary code with the privileges of the current user if a victim opens a malicious file. The attack requires user interaction and no authentication; the vulnerability is rated High with a CVSS score of 7.8.
Affected
- Adobe Substance 3D Stager 3.1.8 and earlier (Windows and macOS)
Fixed in
- Adobe Substance 3D Stager 3.1.9 (via Creative Cloud desktop app or Admin Console)
Workaround
- Unknown. No Adobe-published workaround for this CVE was found; updating to 3.1.9 is the recommended remedy.
Exploitation
- Adobe is not aware of any exploits in the wild.
- CISA KEV status not verified directly; a third-party tracker lists it as not in KEV.
- No public proof-of-concept or exploit code was found.
Our recommendation
- Inventory all installations of Substance 3D Stager.
- Update to version 3.1.9 or later via the Creative Cloud desktop app within the normal workstation patch window.
- Remind users not to open Stager project files from unknown or unexpected senders.
- Monitor for further Stager updates, as related memory-safety issues have been fixed in recent releases.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-170 www.adobe.com
- CVE record mirror (Vulners) vulners.com
- Tenable/Nessus plugin check for APSB26-170 vulners.com
- Strix CVE-2026-103843 www.strix.ai
- Strix CVE-2026-27309 (related Stager use-after-free) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:16.
Original description (NVD)
Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.