A NULL pointer dereference in Substance3D – Painter allows an attacker to crash the application, causing a denial of service. This flaw is classified as CWE‑476: Null Pointer Dereference and can be triggered when the program processes a specially crafted file. The impact is local to the affected instance, resulting in an unresponsive application but not to system compromise.

Adobe’s Substance3D Painter versions 11.1.2 and earlier are vulnerable. The affected product is Adobe Substance3D Painter for desktop; the CPE reflects adobe:substance_3d_painter. Users running these releases are exposed if they open malicious or malformed files.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no public exploits are known. Attackers must deliver a malicious file and obtain user interaction to trigger the crash, so the attack vector is local file-based.