CVE-2026-21287
Published: 13 January 2026
Summary
CVE-2026-21287 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21287 is a Use After Free vulnerability (CWE-416) affecting Adobe Substance3D Stager versions 3.1.5 and earlier. Published on 2026-01-13, the flaw has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and could result in arbitrary code execution in the context of the current user.
Exploitation requires local access and user interaction, as a victim must open a malicious file to trigger the issue. An unprivileged attacker (PR:N) can craft such a file with low complexity (AC:L), leading to high-impact confidentiality, integrity, and availability violations without changing scope.
Adobe Security Bulletin APSB26-09, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb26-09.html, details the vulnerability and associated patches for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2047
Vulnerability details
Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
UAF in desktop client app enables code exec via malicious file opened by user (T1204.002), directly exploiting client software vulnerability (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the Use After Free vulnerability by requiring timely patching of Substance3D Stager to the fixed version as specified in Adobe bulletin APSB26-09.
Implements memory protection mechanisms such as ASLR and DEP to minimize the impact of Use After Free exploits leading to arbitrary code execution.
Provides malicious code scanning and protection to block execution of arbitrary code triggered by the exploitation of the Use After Free vulnerability upon opening malicious files.