CVE-2026-103835: Out-of-bounds Write (CWE-787) in Adobe Adobe Substance 3D Stager

CVE-2026-103835 is an out-of-bounds write vulnerability in Adobe Substance 3D Stager that allows an attacker to execute arbitrary code in the context of the current user. Successful exploitation requires the victim to open a crafted malicious file. The vulnerability affects versions >=0 and <=3.1.8. The CVSS v3.1 base score is 7.8, indicating a high severity with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability could allow an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected system's user context. The attack requires user interaction, limiting remote exploitation scenarios. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when opening files from untrusted sources to prevent exploitation.