Description
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via application crash
Action: Patch Now
AI Analysis

Impact

The vulnerability is a null pointer dereference that causes the Substance 3D Designer application to crash, resulting in a denial‑of‑service situation. An attacker can deliver a malicious file that, when opened, triggers the dereference and terminates the application.

Affected Systems

Adobe Substance 3D Designer is affected; no specific version range is provided, so any installation could potentially be vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score below 1% reflects a very low but non‑zero probability of exploitation. Because the attack requires the victim to open a malicious file, the vector is user interaction. The vulnerability is not listed in CISA’s KEV catalog, so there is no known public exploitation yet, but the crash could disrupt critical design workflows.

Generated by OpenCVE AI on October 16, 2026 at 03:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Adobe Substance 3D Designer to the latest version that contains the fix for the null pointer dereference.
  • Limit the opening of unknown or untrusted files, using sandboxing or file‑type restrictions, until the update is installed.
  • Monitor the application for unexpected crashes and report incidents to Adobe Security to speed remediation.

Generated by OpenCVE AI on October 16, 2026 at 03:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe substance 3d Designer
Apple
Apple macos
Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:substance_3d_designer:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Adobe
Adobe substance 3d Designer
Apple
Apple macos
Microsoft
Microsoft windows

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Substance3D - Designer | NULL Pointer Dereference (CWE-476)
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Adobe Substance 3d Designer
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T14:53:05.786Z

Reserved: 2026-10-01T11:23:23.937Z

Link: CVE-2026-103828

cve-icon Vulnrichment

Updated: 2026-10-14T14:44:50.757Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T21:17:24.003

Modified: 2026-10-15T18:42:53.987

Link: CVE-2026-103828

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T03:45:17Z

Weaknesses