CVE-2026-21341
Published: 10 February 2026
Summary
CVE-2026-21341 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 12.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds write vulnerability in Substance3D Stager by identifying, prioritizing, and applying vendor-provided patches timely.
Mitigates arbitrary code execution from the out-of-bounds write through memory protections such as address space randomization, non-executable memory, and stack canaries.
Scans for and blocks malicious files exploiting the vulnerability before they can be opened and processed by Substance3D Stager.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in file parser enables RCE when victim opens crafted malicious file (T1204.002).
NVD Description
Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2026-21341 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Stager versions 3.1.6 and earlier. The flaw occurs during processing of malicious files and can result in arbitrary code execution in the context of the current user.
Exploitation requires local access and user interaction, as a victim must open a specially crafted malicious file. No privileges are needed (PR:N), attack complexity is low (AC:L), and there is no change in scope (S:U). A successful attack grants high-impact access to confidentiality, integrity, and availability, earning a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Mitigation details are provided in Adobe Product Security Bulletin APSB26-20, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb26-20.html.
Details
- CWE(s)