CVE-2026-103835: Adobe Substance3D Stager RCE Vulnerability

CVE-2026-103835 Overview

CVE-2026-103835 is an out-of-bounds write vulnerability [CWE-787] in Adobe Substance3D Stager. The flaw allows an attacker to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a crafted malicious file in Substance3D Stager.

Adobe addressed the issue in Security Bulletin APSB26-170. The vulnerability carries local attack vector characteristics and does not require any privileges, but relies on social engineering to trick a user into opening the attacker-supplied file.

Critical Impact

Successful exploitation grants arbitrary code execution with the privileges of the current user, enabling malware installation, data theft, or lateral movement from a workstation.

Affected Products

• Adobe Substance3D Stager (see Adobe Security Bulletin APSB26-170 for affected versions)
• Windows installations of Substance3D Stager
• macOS installations of Substance3D Stager

Discovery Timeline

• 2026-10-13 - CVE-2026-103835 published to the National Vulnerability Database (NVD)
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-103835

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition classified under [CWE-787]. Substance3D Stager writes data past the bounds of an allocated buffer when parsing a specific file structure. Attackers can craft a malicious scene, asset, or project file that triggers the memory corruption during load.

Because the write occurs in a user-mode process, successful exploitation yields code execution at the current user's privilege level. On systems where the user holds administrative rights, the impact extends to full workstation compromise. The flaw affects confidentiality, integrity, and availability of the host.

Adobe's Security Bulletin APSB26-170 is the authoritative source for affected version ranges and fixed builds. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper validation of input data lengths or indices during file parsing. The parser writes attacker-controlled data outside the intended buffer boundaries, corrupting adjacent memory. Depending on what memory is overwritten, attackers can hijack control flow by corrupting function pointers, vtables, or return addresses.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized Substance3D project or asset file through phishing email, compromised download sites, or shared asset libraries. When a victim opens the file in Substance3D Stager, the malformed structure triggers the out-of-bounds write and executes attacker-supplied shellcode.

No verified proof-of-concept code is publicly available. See the Adobe Security Bulletin APSB26-170 for additional technical details.

Detection Methods for CVE-2026-103835

Indicators of Compromise

• Unexpected child processes spawned by the Substance3D Stager executable, particularly shells (cmd.exe, powershell.exe, /bin/sh) or script interpreters
• Substance3D Stager process crashes correlated with opening third-party or email-delivered project files
• Outbound network connections from the Substance3D Stager process to unknown hosts shortly after file open
• New persistence artifacts (scheduled tasks, Run keys, Launch Agents) created within minutes of opening a Substance3D asset

Detection Strategies

• Hunt for anomalous process ancestry where Substance3D Stager is the parent of interpreter or living-off-the-land binaries
• Monitor for memory access violations and crash dumps generated by the Substance3D Stager process
• Flag Substance3D project files delivered via email attachments or downloaded from untrusted sources
• Correlate file-open telemetry with subsequent process execution and network activity on the same host

Monitoring Recommendations

• Enable endpoint detection and response (EDR) telemetry on all workstations running Adobe Substance3D Stager
• Collect and retain application crash events (WER on Windows, crash reports on macOS) for the Stager process
• Alert on executions of Substance3D Stager outside of normal creative workflows or working hours
• Track inbound Substance3D asset files from external email senders or cloud storage links

How to Mitigate CVE-2026-103835

Immediate Actions Required

• Apply the Adobe security update for Substance3D Stager as documented in APSB26-170
• Inventory all endpoints running Substance3D Stager and prioritize patching for users who handle external assets
• Instruct users to open Substance3D files only from trusted internal sources until patching completes
• Review email gateway and web proxy policies to filter or quarantine Substance3D project files from untrusted senders

Patch Information

Adobe released fixed versions of Substance3D Stager in Security Bulletin APSB26-170. Refer to the Adobe Security Bulletin APSB26-170 for the specific patched version numbers and download links. Update through the Adobe Creative Cloud desktop application or the standalone installer provided by Adobe.

Workarounds

• Restrict Substance3D Stager usage to standard user accounts to limit the impact of successful exploitation
• Block Substance3D project file extensions at the email gateway for untrusted external senders
• Use application allowlisting to prevent Substance3D Stager from launching unexpected child processes
• Isolate workstations handling third-party 3D assets on segmented network zones with limited lateral movement

# Example: query installed Substance3D Stager version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation