CVE-2026-103852

MediumCVSS 5.5/10Last modified Oct 15, 2026

Description

Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1038535.5Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage t CVE-2026-1038547.8Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the cur CVE-2026-1038555.5Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could e CVE-2026-1038565.5Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could lev CVE-2026-1038575.5Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could lev CVE-2026-1038585.3MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies t CVE-2026-1038686.5A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused fo CVE-2026-1038696.5A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and re CVE-2026-1038705.0A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user CVE-2026-1038779.8Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answe CVE-2026-1038787.5Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a CVE-2026-1038807.5Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high for