A null pointer dereference flaw exists in Adobe Substance3D Painter. When a specially crafted file is opened, a null pointer is dereferenced during processing, causing the application to crash. This results in denial of service for the application and any services that rely on it. The issue stems from insufficient null checks during file handling (CWE‑476). The likely attack vector is user interaction, where a victim must open a malicious file.

Adobe Substance3D Painter versions 11.1.2 and earlier are affected. The vulnerability is present in all earlier releases, so any installations using those versions are at risk until upgraded.

The CVSS v3.1 base score of 5.5 indicates a moderate risk, with exploitation likelihood indicated by an EPSS score of less than 1%. The vulnerability is not in CISA's KEV catalog. Attack requires the victim to open a crafted file, so it is a user‑interaction exploit; the adversary must first deliver the file, but the crash can be triggered by any legitimate user opening it. Due to the low exploitation probability, the overall threat is moderate, but the impact on availability can be significant for users who rely heavily on Substance3D Painter.