PatchSiren cyber security CVE debrief

CVE-2026-103843 Adobe CVE debrief

CVE-2026-103843 is a Use After Free vulnerability in Adobe Substance 3D Stager that could result in arbitrary code execution. This CVE was published on 2026-10-13T19:59:50.546Z and was last modified on 2026-10-14T10:40:54.945Z. The NVD entry is currently HIGH. The vulnerability affects Adobe Substance 3D Stager, a software used for 3D modeling and rendering. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. Exploitation of this issue requires user interaction, as a victim must open a malicious file. Defenders responsible for Adobe Substance 3D Stager installations should prioritize verifying and applying the vendor's patch for versions prior to 3.1.9.

Vendor: Adobe
Product: Adobe Substance 3D Stager
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-13
Original CVE updated: 2026-10-14
Advisory published: 2026-10-13
Advisory updated: 2026-10-14

Who should care

Defenders responsible for Adobe Substance 3D Stager installations, as well as users who interact with files from untrusted sources, should be aware of this vulnerability and take steps to verify and apply the vendor's patch.

Why it matters

CVE-2026-103843 is a Use After Free vulnerability in Adobe Substance 3D Stager that could result in arbitrary code execution. Defenders should prioritize verifying and applying the vendor's patch for versions prior to 3.1.9.

Potential arbitrary code execution in the context of the current user
User interaction required to exploit the vulnerability
Verification of vendor patch application is necessary

Technical summary

A Use After Free vulnerability in Adobe Substance 3D Stager could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file. The vulnerability is caused by the software's improper handling of memory, leading to a use-after-free condition. This can be exploited by an attacker to execute arbitrary code on the affected system. The vendor has released a patch for this vulnerability, and users are advised to apply it as soon as possible.

Defensive priority

Defenders should prioritize verifying and applying the vendor's patch for Adobe Substance 3D Stager versions prior to 3.1.9.

Recommended defensive actions

Verify and apply the vendor's patch for Adobe Substance 3D Stager versions prior to 3.1.9
Inventory Adobe Substance 3D Stager installations to identify potential exposure
Monitor for suspicious activity related to Adobe Substance 3D Stager

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but additional verification is needed to confirm affected versions and exploitation.

Sources and references

Verified primary and authoritative sources

CVE-2026-103843 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-103843

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-103843 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-103843

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Substance3D - Stager | Use After Free (CWE-416)
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103843.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html

Supplemental source - vendor-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.