Cyber Posture

CVE-2026-21342

High

Published: 10 February 2026

Published
10 February 2026
Modified
11 February 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0001 2.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21342 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-11 (User-installed Software).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mandates timely identification, reporting, and correction of software flaws like the out-of-bounds write vulnerability in Substance3D Stager versions 3.1.6 and earlier via patching.

prevent

Provides memory protections such as ASLR, DEP, and stack canaries that mitigate successful exploitation of the out-of-bounds write leading to arbitrary code execution.

prevent

Enforces policies to restrict user installation of vulnerable or unpatched versions of applications like Substance3D Stager.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Out-of-bounds write in file-processing client app enables arbitrary code execution via malicious file opened by user (T1204.002) and direct client-side exploitation (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…

more

open a malicious file.

Deeper analysisAI

CVE-2026-21342 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Stager versions 3.1.6 and earlier. The flaw occurs when processing malicious files, potentially leading to arbitrary code execution in the context of the current user.

Exploitation requires local access and user interaction, as a victim must open a specially crafted malicious file. No privileges are needed (PR:N), with low attack complexity (AC:L). Successful attacks can result in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), earning a CVSS v3.1 base score of 7.8.

Adobe's Product Security Bulletin APSB26-20, published in relation to this CVE and available at https://helpx.adobe.com/security/products/substance3d_stager/apsb26-20.html, details the vulnerability and provides guidance on mitigation.

Details

CWE(s)

Affected Products

adobe
substance 3d stager
≤ 3.1.7

CVEs Like This One

CVE-2025-21132Same product: Adobe Substance 3D Stager
CVE-2026-27279Same product: Adobe Substance 3D Stager
CVE-2025-21131Same product: Adobe Substance 3D Stager
CVE-2026-27273Same product: Adobe Substance 3D Stager
CVE-2026-27275Same product: Adobe Substance 3D Stager
CVE-2025-21130Same product: Adobe Substance 3D Stager
CVE-2026-21341Same product: Adobe Substance 3D Stager
CVE-2026-27274Same product: Adobe Substance 3D Stager
CVE-2025-21129Same product: Adobe Substance 3D Stager
CVE-2026-21327Same product: Apple Macos

References