Out-of-Bounds Read Vulnerability in Substance3D - Stager by Adobe

CVE-2026-21345

What is CVE-2026-21345?

Substance3D - Stager versions 3.1.6 and earlier are susceptible to an out-of-bounds read vulnerability during the parsing of specially crafted files. This vulnerability allows an attacker to read memory beyond allocated structures, presenting a significant risk for potential code execution within the context of the current user. Successful exploitation necessitates that the victim opens a malicious file, thereby enabling the attacker’s malicious code execution.

References