Description
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The vulnerability is a NULL pointer dereference that allows an attacker to crash the Substance 3D Designer application. This results in a denial-of-service condition, preventing legitimate users from opening the program until it is restarted. The weakness is classed as CWE-476, indicating improper handling of a null reference.

Affected Systems

Adobe Substance 3D Designer for all currently supported versions is affected. No specific product versions are listed, so any deployment of the application without a recent update may be vulnerable.

Risk and Exploitability

The CVSS score of 5.5 reflects a moderate severity, driven by the necessity of user interaction and the limited impact to confidentiality or integrity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not in the CISA KEV catalog, meaning there are no known targeted exploits. An attacker would need to supply a malicious file that the user opens within the application; no network or remote exploitation is required.

Generated by OpenCVE AI on October 16, 2026 at 03:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Adobe Substance 3D Designer update that includes the fix for CVE-2026-103826.
  • Restrict access to the application by disallowing or strictly vetting files from untrusted sources.
  • Implement monitoring for Application Not Responding (ANR) events to detect crashes and trigger an automated restart or alert.

Generated by OpenCVE AI on October 16, 2026 at 03:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe substance 3d Designer
Apple
Apple macos
Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:substance_3d_designer:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Adobe
Adobe substance 3d Designer
Apple
Apple macos
Microsoft
Microsoft windows

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Substance3D - Designer | NULL Pointer Dereference (CWE-476)
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Adobe Substance 3d Designer
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T14:53:05.416Z

Reserved: 2026-10-01T11:23:23.936Z

Link: CVE-2026-103826

cve-icon Vulnrichment

Updated: 2026-10-14T14:44:37.704Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T21:17:23.783

Modified: 2026-10-15T18:43:01.900

Link: CVE-2026-103826

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T03:45:17Z

Weaknesses