Substance3D Designer versions 15.1.0 and earlier contain a null pointer dereference that can be triggered by opening a crafted file. When the vulnerability is abused, the application crashes, resulting in a denial of service that disrupts user productivity and any services that rely on the software. The weakness is identified as a null pointer dereference (CWE-476).

The affected product is Adobe Substance3D Designer, specifically all releases up to and including version 15.1.0. Users running any earlier build are exposed to the flaw.

The CVSS score of 5.5 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation. Exploitation requires a user to open a malicious file, so the attack vector is user-interaction dependent, typically local. Organizations should assess the likelihood of users handling untrusted assets before prioritizing remediation.