Description
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a NULL pointer dereference that can crash the Substance 3D Designer application. If triggered, the program terminates abruptly, resulting in a denial‑of‑service for the user. The weakness is identified as CWE-476.

Affected Systems

Adobe Substance 3D Designer is affected. Specific version numbers are not disclosed, so any installation of the application is at risk.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability requires user interaction: a victim must open a malicious file. The likely attack vector is local and relies on a compromised file rather than remote access, based on the limited information provided. Though the vulnerability is not listed in CISA KEV, the denial‑of‑service impact warrants remediation.

Generated by OpenCVE AI on October 16, 2026 at 03:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Adobe Substance 3D Designer to the latest version that contains the fix.
  • Train users to avoid opening files from untrusted or unknown sources and verify file integrity before opening.
  • Configure the application or operating system to run Substance 3D Designer in a sandboxed or restricted environment when processing external files, where possible.

Generated by OpenCVE AI on October 16, 2026 at 03:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe substance 3d Designer
Apple
Apple macos
Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:substance_3d_designer:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Adobe
Adobe substance 3d Designer
Apple
Apple macos
Microsoft
Microsoft windows

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Substance3D - Designer | NULL Pointer Dereference (CWE-476)
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Adobe Substance 3d Designer
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T14:53:05.280Z

Reserved: 2026-10-01T11:23:23.936Z

Link: CVE-2026-103824

cve-icon Vulnrichment

Updated: 2026-10-14T14:44:31.419Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T21:17:23.560

Modified: 2026-10-15T18:43:11.420

Link: CVE-2026-103824

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T20:30:17Z

Weaknesses