CVE-2026-21345: Adobe Substance 3D Stager RCE Vulnerability

CVE-2026-21345 Overview

CVE-2026-21345 is an out-of-bounds read vulnerability affecting Adobe Substance 3D Stager versions 3.1.6 and earlier. The vulnerability occurs when parsing a crafted file, resulting in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.

Critical Impact

This vulnerability enables attackers to execute arbitrary code with user-level privileges by convincing victims to open specially crafted files in Adobe Substance 3D Stager.

Affected Products

• Adobe Substance 3D Stager versions 3.1.6 and earlier
• Affected platforms: Apple macOS
• Affected platforms: Microsoft Windows

Discovery Timeline

• 2026-02-10 - CVE-2026-21345 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-21345

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption issue that occurs when Adobe Substance 3D Stager attempts to parse specially crafted files. The application fails to properly validate memory boundaries during file parsing operations, allowing read operations beyond the allocated buffer. This can lead to information disclosure by reading sensitive data from adjacent memory regions, and in some cases, can be leveraged to achieve code execution.

The local attack vector requires an attacker to deliver a malicious file to the victim through phishing, file sharing, or other social engineering techniques. Once the victim opens the file in Substance 3D Stager, the parsing routine triggers the out-of-bounds read condition, potentially allowing the attacker to execute code with the privileges of the current user.

Root Cause

The root cause of this vulnerability lies in insufficient boundary checking during the file parsing routine in Adobe Substance 3D Stager. When processing certain file structures, the application reads memory beyond the bounds of allocated buffers without proper validation, leading to the out-of-bounds read condition. This memory safety issue allows attackers to potentially access sensitive information or corrupt program execution flow.

Attack Vector

The attack vector for CVE-2026-21345 requires local access and user interaction. An attacker must craft a malicious file designed to trigger the out-of-bounds read when parsed by Substance 3D Stager. The attack scenario typically involves:

1. The attacker creates a specially crafted file exploiting the parsing vulnerability
2. The malicious file is delivered to the victim via email attachment, file sharing services, or compromised websites
3. The victim opens the file using Adobe Substance 3D Stager
4. The vulnerable parsing routine processes the malicious input, triggering the out-of-bounds read
5. The attacker achieves code execution in the context of the current user

The vulnerability manifests during file parsing operations in Adobe Substance 3D Stager. For detailed technical information, refer to the Adobe Security Advisory APSB26-20.

Detection Methods for CVE-2026-21345

Indicators of Compromise

• Unexpected crashes or memory access violations in Adobe Substance 3D Stager
• Suspicious files with unusual structures or abnormally large field values being opened in the application
• Process creation events spawned from Substance 3D Stager that are outside normal application behavior
• Anomalous memory access patterns during file parsing operations

Detection Strategies

• Monitor for abnormal process behavior from Adobe Substance 3D Stager processes, including unexpected child process creation
• Implement endpoint detection rules to identify potential exploitation attempts targeting file parsing routines
• Deploy file inspection capabilities to analyze files before they reach end users
• Configure application-level logging to capture file operations and parsing events

Monitoring Recommendations

• Enable detailed logging for Adobe Substance 3D Stager application events
• Monitor file access patterns, particularly for files with unusual extensions or structures associated with 3D design workflows
• Implement network monitoring to detect suspicious file downloads targeting creative software users
• Establish baseline behavior for Substance 3D Stager to identify deviations that may indicate exploitation

How to Mitigate CVE-2026-21345

Immediate Actions Required

• Update Adobe Substance 3D Stager to the latest version that addresses CVE-2026-21345
• Instruct users to exercise caution when opening files from untrusted sources
• Implement file filtering at email gateways to scan attachments for potential exploits
• Consider temporarily restricting the use of Substance 3D Stager until patching is complete

Patch Information

Adobe has released a security update to address this vulnerability. Organizations should apply the patch as soon as possible. For detailed patch information and download instructions, refer to the Adobe Security Advisory APSB26-20.

Workarounds

• Avoid opening files from untrusted or unknown sources in Adobe Substance 3D Stager
• Implement application whitelisting to control which processes can execute from Substance 3D Stager
• Use sandboxed environments or virtual machines when working with files from external sources
• Deploy endpoint protection solutions to detect and block exploitation attempts

Organizations should follow Adobe's security guidance and apply the official patch. Users on Windows and macOS platforms should verify they are running a patched version of Adobe Substance 3D Stager (later than version 3.1.6).