CVE-2026-27276
Published: 10 March 2026
Summary
CVE-2026-27276 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27276 is a Use After Free vulnerability (CWE-416) affecting Adobe Substance3D Stager versions 3.1.7 and earlier. The flaw could result in arbitrary code execution in the context of the current user when a victim opens a malicious file.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). An attacker with local access can exploit it with low complexity and no required privileges, but it demands user interaction for the victim to open a specially crafted malicious file. Successful exploitation enables arbitrary code execution, compromising confidentiality, integrity, and availability at a high level within the user's context.
Adobe Security Bulletin APSB26-29 provides details on mitigation and patches for Substance3D Stager, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb26-29.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10778
Vulnerability details
Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in client application enables RCE via malicious file opened by user, mapping directly to Exploitation for Client Execution and User Execution: Malicious File.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the Use After Free vulnerability by applying patches from Adobe Security Bulletin APSB26-29 to Substance3D Stager.
Vulnerability scanning identifies installations of vulnerable Substance3D Stager versions 3.1.7 and earlier for timely remediation.
Memory protection mechanisms like ASLR and DEP mitigate arbitrary code execution from the Use After Free flaw during malicious file processing.