Description
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-02-10
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch Now
AI Analysis

Impact

Substance3D Designer versions 15.1.0 and earlier contain an out‑of‑bounds read that can expose data stored in memory. The flaw arises when the software reads beyond the bounds of a buffer, potentially leaking sensitive information. The issue is classified as CWE‑125.

Affected Systems

Adobe Substanеt3D Designer 15.1.0 and any earlier release are affected.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not recorded in CISA’s KEV catalog. The flaw requires user interaction; a victim must open a malicious file for the read to occur, which limits the attacker’s reach to scenarios where a user can be lured to process a file.

Generated by OpenCVE AI on April 18, 2026 at 12:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Adobe security update for Substance3D Designer as detailed in the advisory linked above. This patch resolves the out‑of‑bounds read by adding proper bounds checks. Its application eliminates the immediate memory exposure risk.
  • Limit users’ ability to open files from untrusted or unknown sources. Enforce strict file‑import policies or apply content filtering to prevent accidental processing of malicious documents. This mitigates the user‑interaction prerequisite of the vulnerability.
  • Verify that no legacy or unsupported versions of Substance3D Designer remain installed; uninstall or upgrade any such instances to ensure the out‑of‑bounds read is patched.

Generated by OpenCVE AI on April 18, 2026 at 12:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Feb 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe substance 3d Designer
CPEs cpe:2.3:a:adobe:substance_3d_designer:*:*:*:*:*:*:*:*
Vendors & Products Adobe
Adobe substance 3d Designer

Tue, 10 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 18:15:00 +0000

Type Values Removed Values Added
Description Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Substance3D - Designer | Out-of-bounds Read (CWE-125)
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Adobe Substance 3d Designer
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-02-10T18:55:25.959Z

Reserved: 2025-12-12T22:01:18.195Z

Link: CVE-2026-21340

cve-icon Vulnrichment

Updated: 2026-02-10T18:55:15.257Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-10T18:16:32.243

Modified: 2026-02-11T17:30:04.457

Link: CVE-2026-21340

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T12:45:45Z

Weaknesses