CVE-2026-27309 is a Use After Free vulnerability in Adobe Substance3D - Stager (version 3.1.7 and earlier). This vulnerability allows an attacker to execute arbitrary code in the context of the current user if the victim opens a specially crafted malicious file. The vulnerability is classified under CWE-416 and has a CVSS 3.1 base score of 7.8, indicating high severity. The attack vector requires local user interaction (opening a file), and the vulnerability impacts confidentiality, integrity, and availability.

Successful exploitation could lead to arbitrary code execution with the privileges of the current user, potentially compromising the affected system's confidentiality, integrity, and availability. The requirement for user interaction limits the attack vector to scenarios where a user is tricked into opening a malicious file. No known exploits are reported in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening untrusted or suspicious files with Substance3D - Stager. Monitor Adobe's security advisories for updates regarding patches or mitigations.