CVE-2026-21342
Published: 10 February 2026
Summary
CVE-2026-21342 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-11 (User-installed Software).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and correction of software flaws like the out-of-bounds write vulnerability in Substance3D Stager versions 3.1.6 and earlier via patching.
Provides memory protections such as ASLR, DEP, and stack canaries that mitigate successful exploitation of the out-of-bounds write leading to arbitrary code execution.
Enforces policies to restrict user installation of vulnerable or unpatched versions of applications like Substance3D Stager.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in file-processing client app enables arbitrary code execution via malicious file opened by user (T1204.002) and direct client-side exploitation (T1203).
NVD Description
Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2026-21342 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Stager versions 3.1.6 and earlier. The flaw occurs when processing malicious files, potentially leading to arbitrary code execution in the context of the current user.
Exploitation requires local access and user interaction, as a victim must open a specially crafted malicious file. No privileges are needed (PR:N), with low attack complexity (AC:L). Successful attacks can result in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), earning a CVSS v3.1 base score of 7.8.
Adobe's Product Security Bulletin APSB26-20, published in relation to this CVE and available at https://helpx.adobe.com/security/products/substance3d_stager/apsb26-20.html, details the vulnerability and provides guidance on mitigation.
Details
- CWE(s)