CVE-2026-21287: 
Adobe Substance 3D Stager vulnerability analysis and mitigation

CVE-2026-21287 is a Use After Free (UAF) vulnerability in Adobe Substance 3D Stager that can result in arbitrary code execution in the context of the current user. It affects Substance 3D Stager versions 3.1.5 and earlier, running on both Windows and macOS. The vulnerability was disclosed on January 13, 2026, with an initial NVD analysis completed on January 14, 2026. It carries a CVSS v3.1 base score of 7.8 (High), assigned by Adobe Systems Incorporated (Adobe Advisory, Feedly).

The vulnerability is classified as CWE-416 (Use After Free), meaning the application references memory after it has been freed, potentially allowing an attacker to control program execution flow. Exploitation requires a local attack vector with no privileges required, but does require user interaction — specifically, a victim must open a specially crafted malicious file. The low attack complexity means no special conditions or race conditions are needed beyond convincing the target to open the file. No public technical write-ups or proof-of-concept code have been identified at this time (Adobe Advisory, Feedly).

Successful exploitation allows an unauthenticated local attacker to execute arbitrary code with the privileges of the user running Adobe Substance 3D Stager, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files accessible to the victim user, modify or delete data, or cause application crashes. The scope is limited to the current user context and does not inherently enable privilege escalation or lateral movement beyond the compromised user account (Adobe Advisory, Feedly).

1. Craft a malicious file: An attacker creates a specially crafted file (e.g., a 3D scene or project file) designed to trigger the use-after-free condition in Adobe Substance 3D Stager's file parsing logic.
2. Deliver the file: The attacker delivers the malicious file to the target via email attachment, file sharing platform, or social engineering, convincing the victim to open it with Substance 3D Stager.
3. Trigger the UAF condition: When the victim opens the file, the application processes it and references previously freed memory, allowing the attacker to control the freed memory region with attacker-controlled data.
4. Achieve code execution: By controlling the freed memory, the attacker redirects program execution to a shellcode or ROP chain, executing arbitrary code in the context of the victim user (Adobe Advisory).

• Process: Unexpected child processes spawned by the Adobe Substance 3D Stager process (e.g., cmd.exe, powershell.exe, bash, curl, or other shells/utilities not normally associated with the application).
• File System: Unexpected files written to user-accessible directories (e.g., %APPDATA%, %TEMP%, or ~/Library/) shortly after opening a Substance 3D Stager file; presence of unfamiliar or recently modified project files from unknown sources.
• Network: Outbound network connections initiated by the Substance 3D Stager process to unknown or suspicious external IP addresses or domains, particularly following the opening of an external file.
• Logs: Application crash logs or error reports from Substance 3D Stager referencing memory access violations or heap corruption around file-open events.

Adobe has released a patch in Substance 3D Stager version 3.1.6, which resolves this vulnerability. Users should update to version 3.1.6 or later as the primary remediation step. As a workaround, users should avoid opening Substance 3D Stager files received from untrusted or unknown sources. Organizations may also consider implementing application whitelisting and restricting file execution permissions where feasible (Adobe Advisory).

The vulnerability was noted in the January 2026 security update review by Zero Day Initiative and covered in CISA's weekly vulnerability bulletin for the week of January 12, 2026. CIS also published an advisory noting that multiple Adobe vulnerabilities disclosed in January 2026 could allow for arbitrary code execution. Community coverage was limited to standard vulnerability aggregation and tracking platforms, with no significant researcher commentary or social media discussion identified (CIS Advisory, CISA Bulletin).