EUVD-2026-100700
GHSA-v9w9-v5fc-9chg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Substance 3D file
-
DeliveryDeliver file to target artist
-
ExploitVictim opens file in Designer
-
ExecutionNULL pointer dereference in parser
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-supplied malicious file in Adobe Substance 3D Designer version 16.0.4 or earlier; there is no network-facing or unauthenticated path. Limiting factors are significant: the attack vector is local (AV:L) with mandatory user interaction (UI:R), so an attacker must first deliver the crafted file and socially engineer the artist into opening it. The impact is confined to an application crash (availability only) - no data disclosure, modification, or code execution results - which substantially bounds realistic risk. |
| Impact | This is a moderate-severity, low-priority issue despite being a confirmed Adobe PSIRT advisory. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) tells a consistent story: a LOCAL attack vector combined with required user interaction (victim must open a malicious file), yielding ONLY availability impact (application crash) with no confidentiality or integrity loss. The impact is a NULL pointer dereference (CWE-476) that terminates the application - not code execution. No EPSS score, KEV listing, or public POC was provided in the input: exploitation status is therefore 'no public exploit identified at time of analysis.' There is no signal conflict - all sources (CVSS, description, CWE, tags) agree this is a file-parsing denial-of-service requiring social engineering to deliver a crafted file. The absence of confidentiality/integrity impact and the hard requirement for local user interaction make this a low-urgency patch, not an emergency. Real-world risk is limited to loss of unsaved work and workflow disruption for an artist who opens an untrusted project/material file. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Designer project or asset file engineered to trigger a NULL pointer dereference during parsing, then delivers it to a victim (e.g., via a shared material pack, marketplace download, or email). When the victim opens the file in a vulnerable version (≤16.0.4), the application dereferences a NULL pointer and crashes, causing a denial-of-service. No public exploit code was identified in the provided data, and exploitation yields only an application crash, not code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Opening a specially crafted file in Adobe Substance 3D Designer 16.0.4 and earlier triggers a NULL pointer dereference that crashes the application, resulting in an application-level denial of service. The flaw is not remotely reachable: per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), an attacker must deliver a malicious file to the victim and convince them to open it locally, and the impact is limited to availability - no data disclosure, no file modification, and no code execution. This bounds the issue to moderate severity (CVSS 5.5); no public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published vendor advisory APSB26-169 covering the affected product line.
RemediationAI
Apply the fixed release published in Adobe's advisory APSB26-169 for Substance 3D Designer (https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html); the provided intelligence does not include an exact patched version number, so the Adobe bulletin - not this analysis - is the source of truth for the specific build to install, and any affected installation at 16.0.4 or earlier should be updated through the Creative Cloud desktop application or the vendor download page. Because the attack requires a user to open a malicious file, the most effective compensating controls are delivery-side and workflow-side: block or quarantine untrusted Substance/Designer project files at email and file-transfer gateways, and prohibit opening artwork received from unknown or external sources on production workstations - the trade-off being friction in legitimate external art collaboration pipelines. Where untrusted files must be inspected, run Designer inside a hardened, non-persistent VM or OS-level sandbox under a low-privilege account so a crash cannot affect the host session or other work, accepting the performance and licensing overhead this adds. Note that killbits, WAF rules, or network segmentation are irrelevant here since there is no network attack path; treat crash-recovery (autosave, frequent save cadence) as a resilience measure only, not a fix, and monitor the Adobe advisory for any revision that broadens affected versions or adds a confirmed fix build.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-476, a NULL pointer dereference occurring during parsing of a user-supplied file in Adobe's Substance 3D Designer procedural material/texture authoring application. When the application processes the malformed input, a pointer that the code assumes is valid is dereferenced while null, causing an unhandled fault that terminates the process rather than corrupting memory in an exploitable way - a classic availability-only defect class. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms the file must be opened by a local user with no privileges required (PR:N) but mandatory user interaction (UI:R), the scope remains unchanged, and confidentiality and integrity impact are explicitly None while availability impact is High. No CPE strings were provided in the intelligence feed; the only version scope comes from ENISA EUVD, which lists Substance 3D Designer 0 through 16.0.4 and prior as affected. There is no network-facing service, protocol, or authentication boundary involved - the attack surface is the file-import/parse path inside the desktop application, which is why the vendor classifies it as a denial-of-service issue rather than a memory-corruption or code-execution primitive.
Know when Substance 3d Designer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File must be opened locally by the victim so AV:L and UI:R; no auth needed to deliver the file (PR:N); only an application crash, so C:N/I:N/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Substance 3d Designer
View allOut-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability t
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier via an out-of-bounds write vulnerability that trigg
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier through an out-of-bounds write vulnerability that r
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a cr
Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds writ
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability
Exploit-DB