---
id: CVE-2026-103841
title: >-
  Substance3D - Stager is affected by an out-of-bounds read vulnerability when
  parsing a crafted file, which could result in a read past the end of an
  allocated memory structure
summary: >-
  Substance3D - Stager is affected by an out-of-bounds read vulnerability when
  parsing a crafted file, which could result in a read past the end of an
  allocated memory structure. An attacker could leverage this vulnerability to
  execute cod…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
published: '2026-10-13'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T04:18:09.597'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103841'
references:
  - url: >-
      https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
    label: psirt@adobe.com
tags:
  - nvd
ingestedAt: '2026-10-13T20:53:44.622Z'
---

## Overview

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.