CVE-2023-26392

Deeper analysis

Adobe Substance 3D Stager versions 2.0.1 and earlier contain a use-after-free vulnerability tracked as CVE-2023-26392 and CWE-416. The flaw resides in the application's handling of file data and can be triggered when a user opens a specially crafted file, resulting in arbitrary code execution under the privileges of the current user. The issue carries a CVSS 3.1 score of 7.8 reflecting local attack vector, low complexity, and no required privileges beyond user interaction.

An attacker can exploit the vulnerability by supplying a malicious file to a victim, who must then open it in the affected application. Successful exploitation grants the attacker the ability to execute arbitrary code in the victim's context, potentially leading to full control over the affected system or further lateral movement.

The official Adobe advisory APSB23-26, available at helpx.adobe.com, addresses the issue and directs users to apply the vendor-supplied updates that remediate the use-after-free condition.

EPSS for this CVE rose materially from a low baseline to a peak of 0.0735 on 2025-01-22 before receding to the current value of 0.0023, indicating a period of increased exploitation interest well after the original disclosure.