CVE-2026-21287
📋 TL;DR
CVE-2026-21287 is a use-after-free vulnerability in Substance3D Stager that allows arbitrary code execution when a user opens a malicious file. This affects all users running version 3.1.5 or earlier of the software. Successful exploitation gives attackers the same privileges as the current user.
💻 Affected Systems
- Adobe Substance 3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the user's system, data theft, ransomware deployment, and lateral movement within the network.
Likely Case
Malware installation leading to data exfiltration, credential theft, or system disruption for individual users who open malicious project files.
If Mitigated
Limited impact with proper application whitelisting, file validation, and user training preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.6 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb26-09.html
Restart Required: Yes
Instructions:
1. Open Substance 3D Stager. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Restart the application.
🔧 Temporary Workarounds
Restrict file opening
allOnly open trusted .stg files from verified sources
Application sandboxing
allRun Substance3D Stager in restricted environment
🧯 If You Can't Patch
- Implement application control to block execution of vulnerable versions
- Use endpoint protection with file reputation services to detect malicious files
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Substance3D Stager. If version is 3.1.5 or earlier, system is vulnerable.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 3.1.6 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected file opening events in application logs
Network Indicators:
- Unusual outbound connections after opening .stg files
SIEM Query:
EventID=4688 AND ProcessName='Stager.exe' AND CommandLine LIKE '%.stg%'