A NULL Pointer Dereference in Adobe Substance3D Modeler allows an attacker to cause the application to crash, resulting in denial of service. The vulnerability is a classic example of CWE-476, where improper handling of a null reference can be triggered by malformed input. The impact is confined to the application and does not lead to remote code execution or data leakage.

Adobe Substance3D Modeler versions 1.22.4 and all earlier releases are affected. The issue affects all users running these versions, regardless of operating system, as the vulnerability resides in the core model processing component.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 percent signals a very low probability of exploitation in active environments, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to open a malicious file, so the attack vector is primarily user interaction through file opening or attachment handling. Because the attacker must first convince a user to act, the overall risk is considered low to moderate, but the impact of a single occurrence can disrupt workflows and productivity.