Out-of-Bounds Read Vulnerability in Substance3D Stager by Adobe

CVE-2026-103840

What is CVE-2026-103840?

The Substance3D Stager by Adobe is impacted by an out-of-bounds read vulnerability that occurs during the parsing of specially crafted files. This security flaw may allow an attacker to read beyond the allocated memory, potentially leading to unauthorized code execution in the context of the current user session. Exploitation necessitates user interaction as the malicious file must be opened by a victim.

References