CVE-2026-27277
Published: 10 March 2026
Summary
CVE-2026-27277 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Substance 3D Stager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27277 is a Use After Free vulnerability (CWE-416) affecting Substance3D - Stager versions 3.1.7 and earlier. Published on March 10, 2026, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw occurs during file processing and can lead to arbitrary code execution in the context of the current user.
Exploitation requires local access to the target system and user interaction, specifically convincing a victim to open a malicious file. No privileges are needed beforehand (PR:N), and the attack complexity is low (AC:L). Successful exploitation allows an attacker to achieve high confidentiality, integrity, and availability impacts, executing arbitrary code with the privileges of the user who opens the file.
Adobe Security Bulletin APSB26-29 provides details on mitigation, available at https://helpx.adobe.com/security/products/substance3d_stager/apsb26-29.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10780
Vulnerability details
Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in desktop app file processing enables RCE on opening malicious file (T1204.002); directly matches client application exploitation for code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the Use After Free vulnerability in Substance3D Stager by requiring timely installation of vendor patches to prevent arbitrary code execution.
Implements memory protection safeguards that mitigate exploitation of the Use After Free vulnerability during malicious file processing.
Deploys malicious code protection mechanisms to scan and block malicious files targeting the Use After Free vulnerability before user interaction.