CVE-2026-27275
Published: 10 March 2026
Summary
CVE-2026-27275 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 11.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-27275 by requiring timely patching of the out-of-bounds write vulnerability in Substance3D Stager as per the Adobe security bulletin.
Implements memory protections like ASLR and DEP that prevent reliable exploitation of the out-of-bounds write leading to arbitrary code execution.
Vulnerability scanning identifies installations of vulnerable Substance3D Stager versions affected by CVE-2026-27275 and triggers remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in file parser leads to RCE when victim opens malicious file; directly maps to client-side exploitation (T1203) and user execution of malicious file (T1204.002).
NVD Description
Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2026-27275 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Substance3D Stager versions 3.1.7 and earlier. The flaw occurs during file processing and can lead to arbitrary code execution in the context of the current user. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact with low attack complexity but requiring local access and user interaction.
Exploitation requires a victim to open a malicious file in Substance3D Stager, enabling a local attacker with no privileges to trigger the out-of-bounds write. Successful exploitation allows the attacker to execute arbitrary code with the privileges of the current user, potentially compromising the victim's system through data theft, persistence, or further lateral movement.
The Adobe Security Bulletin APSB26-29 provides details on mitigation, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb26-29.html. Security practitioners should ensure users update to a patched version of Substance3D Stager beyond 3.1.7 and advise caution with untrusted files.
Details
- CWE(s)