EUVD-2026-100703
GHSA-f7hh-wvjx-pqpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted malicious file to victim
-
ExploitVictim opens file in Substance 3D Designer
-
ExecutionNULL pointer dereference triggered in parser
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open an attacker-supplied malicious file (project/asset) in Substance 3D Designer version 16.0.4 or prior; the flaw is reached through the application's file/asset parsing path. Limiting factors that reduce real-world risk: the attack vector is local (AV:L) with no network-facing exposure, it is unauthenticated against the application itself (PR:N) but mandates user interaction (UI:R) - social engineering to get a target to open the crafted file - and the impact is confined to a crash (A:H only), with no confidentiality or integrity consequence and no indication of code execution. |
| Impact | This is a moderate-severity (CVSS 5.5) availability-only issue, not a top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a NULL pointer dereference reached via a local attack vector requiring user interaction - the victim must open a malicious file - with no confidentiality or integrity impact, only a high availability impact (application crash). There is no CISA KEV listing, no EPSS score supplied, and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a file-parsing DoS in a desktop creative tool realistically maps to AV:L + UI:R rather than a remotely automatable exploit, and the absence of C/I impact caps real-world severity. SSVC-style framing would place this as low urgency - technical impact is partial (crash/restart, no code execution claimed), not automatable (requires per-victim social engineering to open a crafted file), and exploitation is not observed. EPSS/KEV data are MISSING from the input; their absence is expected for a client-side DoS and should not be read as evidence either way. Overall: genuine but low operational risk, patch on normal cycle rather than emergency basis. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Designer project or asset file and delivers it via email, a shared asset library, or a marketplace download. When a designer opens the file, a NULL pointer dereference is triggered during parsing, crashing the application and causing loss of unsaved work. No public exploit code is referenced, and the impact is limited to denial-of-service with no code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Opening a specially crafted file in Adobe Substance 3D Designer 16.0.4 and earlier can trigger a NULL pointer dereference that crashes the application, producing a denial-of-service condition. The flaw sits in the application's file/asset parsing path and is only reachable when a victim is persuaded to open an attacker-supplied file, so exploitation depends on user interaction (UI:R) on a local vector (AV:L) rather than any network-facing service. Impact is availability-only (A:H) with no confidentiality or integrity loss and no evidence of code execution; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate-severity (CVSS 5.5), lower-priority availability issue.
RemediationAI
Adobe has published advisory APSB26-169 at https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html covering this issue; the advisory should be consulted for the exact patched build, since no fixed version number was provided in the available data (no vendor-released patch version identified in the provided input). Until an updated build is confirmed, apply compensating controls: enforce a strict policy that users never open Substance 3D Designer project/asset files from untrusted or unsolicited sources, and route incoming .sbs/.sbsar-style assets through a gateway or sandbox that validates or quarantines files before they reach a designer workstation - the trade-off is added workflow friction and potential false positives on legitimate partner assets. Run Designer with least privilege and, where practical, inside an isolated VM or OS-level sandbox so a crash cannot affect other work; note that sandboxing adds overhead and can break GPU/plugin integrations. Enable crash reporting and monitoring so repeated Designer terminations on file open are detected quickly, and disable any auto-preview or thumbnail-generation features that might parse untrusted assets without an explicit user action. These are risk-reduction measures only - because the impact is limited to a local denial-of-service with no code-execution or data-exposure component, they should be prioritised relative to other patching obligations rather than treated as emergency mitigations.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-476, a NULL pointer dereference, occurring during the parsing of project/asset files handled by Substance 3D Designer. When the parser follows a pointer that has not been initialized or has been set to NULL - typically the result of missing validation of a malformed field or structure in the crafted input - the process dereferences an invalid address and terminates. Designer is a 3D material/texture authoring tool whose project files are rich, structured asset containers, so the attack surface is the file-deserialization and asset-loading code path rather than any network listener. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms a local attack vector with low complexity, no privileges required against the application (PR:N), mandatory user interaction (UI:R), unchanged scope, and impact limited to availability (High). EUVD lists affected versions as Substance 3D Designer 0 through 16.0.4 and prior.
Know when Substance 3d Designer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File must be opened locally by a victim so AV:L and UI:R; no auth to run the app gives PR:N; crash-only impact yields C:N/I:N/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Substance 3d Designer
View allOut-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability t
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier via an out-of-bounds write vulnerability that trigg
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier through an out-of-bounds write vulnerability that r
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a cr
Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds writ
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability
Exploit-DB