The vulnerability is a NULL Pointer Dereference that causes the Substance3D – Modeler application to crash when it processes a malicious file. The attack leads to a local application denial of service, allowing an adversary to interrupt the user’s workflow but not to compromise the system isolation or data. The weakness is identified as CWE‑476 and is not an information disclosure or privilege escalation flaw.

Adobe Substance3D – Modeler, versions 1.22.4 and all earlier releases.

The CVSS base score of 5.5 indicates moderate severity. Exploitation requires user interaction – a victim must open a specially crafted file – and the EPSS score is less than 1 %, implying a very low observation of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. With no network‑based exposure, the risk is limited to affected users who may open malicious assets. The low probability of exploit combined with the moderate impact suggests that vigilance is recommended rather than an immediate mandatory fix.