This vulnerability is a NULL pointer dereference inside Adobe Substance3D Designer. When triggered, the application dereferences a null pointer and crashes, resulting in an immediate denial of service to anyone using that instance. The weakness is a classic null pointer error (CWE‑476) and threatens only the local application, not the underlying operating system or other network services.

Adobe Substance3D Designer versions 15.1.0 and earlier are affected. The issue appears in all installations of these versions, regardless of operating system or deployment environment, because the flaw is located in the core file‑processing routine.

The CVSS score of 5.5 places this as a medium severity issue, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first craft a malicious Designer file and convince a victim to open it; remote exploitation is not possible. Because the flaw requires user interaction, the risk is contained to environments where users download or receive Designer files from untrusted sources.