CVE-2026-21343
📋 TL;DR
Substance3D Stager versions 3.1.6 and earlier contain an out-of-bounds read vulnerability when parsing malicious files. An attacker could exploit this to execute arbitrary code with the privileges of the current user. This affects users who open untrusted files with vulnerable versions of Substance3D Stager.
💻 Affected Systems
- Adobe Substance3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware execution when a user opens a crafted malicious file.
If Mitigated
Limited impact with proper file validation and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and crafting specific file formats.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.7 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb26-20.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application. 2. Navigate to Apps > Updates. 3. Find Substance3D Stager and click Update. 4. Restart the application after update completes.
🔧 Temporary Workarounds
Restrict file types
allConfigure system to only allow trusted file types or use application whitelisting
User awareness training
allTrain users to avoid opening untrusted files from unknown sources
🧯 If You Can't Patch
- Implement application control/whitelisting to prevent execution of vulnerable versions
- Use network segmentation to isolate systems running vulnerable software
🔍 How to Verify
Check if Vulnerable:
Check Substance3D Stager version in application About menu or via Creative Cloud appCheck Version:
On Windows: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Substance3D Stager\Version or via Creative Cloud appVerify Fix Applied:
Verify version is 3.1.7 or later in About menu📡 Detection & Monitoring
Log Indicators:
- Application crashes when parsing files
- Unusual file access patterns from Substance3D Stager
Network Indicators:
- Downloads of suspicious file types followed by application execution
SIEM Query:
source="windows-security" EventID=4688 ProcessName="*Stager*" AND CommandLine="*.sbsar" OR "*.sbs"