Substance 3D Designer contains a NULL pointer dereference flaw that can cause the application to crash when it processes a specially crafted file. The resulting crash denies service to the user or other processes that depend on the application. This weakness matches CWE‑476, which represents unguarded null pointer dereferences and does not enable code execution or compromise system confidentiality.

Adobe Substance 3D Designer is affected by this issue. The CNA list identifies the product but no specific version numbers are published, so any installed installation of Substance 3D Designer may be vulnerable until the vendor releases a fix.

With a CVSS score of 5.5 and an EPSS less than 1%, the inherent risk is moderate, and widespread exploitation is unlikely at present. Since the vulnerability is exploited via a malicious file that must be opened by a user, an attacker would need to trick a user into opening the file, implying that the risk is largely driven by social engineering. The issue is not listed in the CISA KEV catalog, and no official patch or workaround has yet been released by Adobe, so the vulnerability remains unpatched until the vendor publishes a fix.