PatchTheCVECVE-2026-103841: Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which cou
CVE-2026-103841 is a high-severity flaw (CVSS 7.8) affecting substance 3d stager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 95%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2026-10-13 |
| Last modified | 2026-10-20 |
Last updated 2026-10-20 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-103841?
substance 3d stager: upgrade to newer than 3.1.8. Exact commands for each OS are on this page.
Is CVE-2026-103841 being exploited?
CVE-2026-103841 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-103841 affect?
CVE-2026-103841 affects substance 3d stager. Severity is high (CVSS 7.8). Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code i
How urgent is CVE-2026-103841?
Priority 29/100. High severity
Related CVEs
- CVE-2026-103843 HIGH 7.8 UPGRADE Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code executi
- CVE-2026-103842 HIGH 7.8 UPGRADE Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which cou
- CVE-2026-103840 HIGH 7.8 UPGRADE Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which cou
- CVE-2026-103839 HIGH 7.8 UPGRADE Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code e
- CVE-2026-103838 HIGH 7.8 UPGRADE Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code e