CVE-2026-103852: Substance3D Stager DOS Vulnerability

CVE-2026-103852 Overview

CVE-2026-103852 is a NULL pointer dereference vulnerability [CWE-476] affecting Adobe Substance3D Stager. An attacker can exploit the flaw to crash the application and trigger a denial-of-service condition on the local host. Exploitation requires user interaction: the victim must open a malicious file crafted by the attacker.

The issue is tracked under Adobe Security Bulletin APSB26-170 and was published to the National Vulnerability Database on 2026-10-13. Impact is limited to availability; the vulnerability does not expose confidentiality or integrity of user data.

Critical Impact
Opening a malicious file in Substance3D Stager causes the application to dereference a NULL pointer and crash, interrupting workflows and causing loss of unsaved work.

Affected Products

Adobe Substance3D Stager (versions listed in Adobe Security Bulletin APSB26-170)
Windows installations of Substance3D Stager
macOS installations of Substance3D Stager

Discovery Timeline

2026-10-13 - CVE-2026-103852 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-103852

Vulnerability Analysis

The flaw is a NULL pointer dereference [CWE-476] inside Adobe Substance3D Stager. When the application parses a specially crafted file, control flow reaches a code path that reads from or writes to a pointer that was never initialized or was set to NULL after a failed allocation or lookup. The dereference triggers an access violation and terminates the process.

Because the attack vector is local and no privileges are required, an attacker only needs to deliver a weaponized project or asset file to a target user. The resulting denial-of-service does not grant code execution or memory disclosure. See the Adobe Security Advisory APSB26-170 for product-specific details.

Root Cause

The root cause is missing validation on a pointer returned by a parsing or object-construction routine. Substance3D Stager accepts the malformed input, proceeds past the point where the pointer should have been checked, and then dereferences it. The absence of a NULL check converts a malformed-input condition into an unhandled fault.

Attack Vector

Exploitation requires local user interaction. An attacker crafts a malicious scene, asset, or project file and convinces a Substance3D Stager user to open it through phishing, a shared asset library, or a compromised download. On open, the application crashes. Repeated exploitation can disrupt production pipelines that rely on Substance3D Stager.

No verified public exploit code or proof-of-concept has been published for this CVE. Vulnerability details are described in prose because no realCodeExamples were released by the vendor or researcher.

Detection Methods for CVE-2026-103852

Indicators of Compromise

Unexpected termination of the Adobe Substance 3D Stager process immediately after a file-open operation.
Windows Application event log entries referencing an access violation (0xC0000005) in the Stager binary.
macOS crash reports in ~/Library/Logs/DiagnosticReports/ naming Substance 3D Stager with an EXC_BAD_ACCESS signal.
Delivery of unsolicited .sbs, .sbsar, .ssa, or related asset files from untrusted senders.

Detection Strategies

Monitor endpoint telemetry for repeated crashes of the Substance 3D Stager process within short time windows.
Correlate email and file-sharing gateway logs with host crash events to identify malicious file delivery.
Flag asset files originating from untrusted domains that are opened in Substance3D Stager.

Monitoring Recommendations

Collect Windows Error Reporting and macOS CrashReporter data from workstations running Substance3D Stager.
Alert on process termination events for Substance3D Stager when accompanied by a parent file-open action from a browser or mail client.
Review file provenance for 3D asset files introduced into shared project repositories.

How to Mitigate CVE-2026-103852

Immediate Actions Required

Apply the Adobe Substance3D Stager security update referenced in Adobe Security Bulletin APSB26-170.
Instruct users to open Substance3D Stager files only from trusted sources until patches are deployed.
Inventory endpoints running Substance3D Stager and prioritize patch rollout to creative and production workstations.

Patch Information

Adobe released fixed versions of Substance3D Stager alongside Security Bulletin APSB26-170 on 2026-10-13. Administrators should consult the bulletin for the specific fixed version numbers for Windows and macOS and deploy them through the Adobe Creative Cloud desktop application or enterprise deployment tooling.

Workarounds

Block or quarantine inbound Substance3D asset files (.sbs, .sbsar, .ssa) from untrusted senders at the mail and web gateways.
Require users to inspect file origin and SHA-256 hash before opening third-party Substance3D assets.
Restrict Substance3D Stager usage to a hardened subset of workstations where endpoint protection and crash telemetry are enforced.

bash

# Configuration example: enumerate installed Substance3D Stager versions on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Stager*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation