CVE-2026-21345: 
Adobe Substance 3D Stager vulnerability analysis and mitigation

CVE-2026-21345 is an out-of-bounds read vulnerability in Adobe Substance 3D Stager that can allow an attacker to execute arbitrary code in the context of the current user. It affects Substance 3D Stager versions 3.1.6 and earlier, with version 3.1.7 introduced as the fix. The vulnerability was disclosed and patched on February 10, 2026, as part of Adobe's February 2026 security update (APSB26-20). It carries a CVSS v3.1 base score of 7.8 (High) (Adobe Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and is triggered during the parsing of a specially crafted file. When a malicious file is opened, the application reads past the end of an allocated memory structure, which can be leveraged to achieve arbitrary code execution. Exploitation requires local access and user interaction — specifically, a victim must be socially engineered into opening a malicious file. The attack vector is local with no privileges required (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the currently logged-in user, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could use this foothold to access sensitive files, install malware, or pivot to other systems accessible by the compromised user account. The scope is limited to the affected host, as the vulnerability does not inherently enable cross-system propagation (Adobe Advisory).

1. Craft a malicious file: Create a specially crafted file (e.g., a 3D scene or project file supported by Substance 3D Stager) that triggers an out-of-bounds read during parsing.
2. Deliver the file: Distribute the malicious file to the target via phishing email, malicious download link, or other social engineering methods.
3. Induce user interaction: Convince the victim to open the malicious file using Substance 3D Stager version 3.1.6 or earlier.
4. Trigger the vulnerability: Upon file parsing, the application reads past the end of an allocated memory buffer (CWE-125), potentially exposing memory contents or corrupting adjacent memory.
5. Achieve code execution: Leverage the out-of-bounds read to execute arbitrary code in the context of the current user, enabling installation of malware, data exfiltration, or further lateral movement (Adobe Advisory).

• File System: Unexpected or unfamiliar 3D project/scene files received via email or downloaded from untrusted sources; new or modified files in Substance 3D Stager working directories.
• Process: Unusual child processes spawned by the Substance 3D Stager process (e.g., cmd.exe, powershell.exe, bash, curl, wget); unexpected network connections initiated by the application.
• Logs: Application crash logs or error reports from Substance 3D Stager referencing memory access violations or out-of-bounds read errors; Windows Event Logs showing application faults tied to the Stager executable.

Adobe has released Substance 3D Stager version 3.1.7 to address this vulnerability, and upgrading to this version or later is the recommended remediation (Adobe Advisory). As an interim measure, users should be educated to avoid opening 3D project files from untrusted or unknown sources. Organizations may also consider restricting the use of Substance 3D Stager to trusted file sources through endpoint controls or application allowlisting until patching is complete.

The Center for Internet Security (CIS) published an advisory noting that multiple Adobe vulnerabilities patched in February 2026, including this one, could allow for arbitrary code execution (CIS Advisory). Tenable released a Nessus detection plugin (ID 298882) for this vulnerability. Coverage was also noted in security aggregators such as BeyondMachines and Fortress SRM as part of broader February 2026 patch roundups.