EUVD-2026-100698
GHSA-p62q-h6r9-3662
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Substance 3D file
-
DeliveryDeliver file to victim (share/email)
-
ExploitVictim opens file in Designer
-
ExecutionTrigger NULL pointer dereference
-
ImpactApplication crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open a malicious file (e.g., a crafted Substance 3D Designer project or asset file) within the application - this is the explicit prerequisite stated in the description and reflected by UI:R. The attack vector is Local (AV:L), so it cannot be triggered remotely over a network; delivery depends on social engineering to get the file onto the victim's machine and opened. There is no authentication requirement on the application side (PR:N), but the hard limiting factor is mandatory user interaction. Impact is limited to a crash/denial-of-service of the Designer application (A:H only); no confidentiality or integrity effect and no code execution is indicated. |
| Impact | This is a moderate, low-priority issue despite a CVSS base score of 5.5 (MEDIUM). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms the impact is availability-only (A:H) with no confidentiality or integrity loss - consistent with a NULL pointer dereference (CWE-476) that merely crashes the application. Although PR:N indicates no privileges are required, the attack vector is Local (AV:L) and requires user interaction (UI:R): a victim must open an attacker-supplied malicious file, so this is not remotely triggerable and depends on social engineering. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation probability signals are absent; the exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (local, user-interaction-driven, availability-only), so there is no major conflict to flag. Net real-world risk is low: a DoS in a desktop 3D authoring tool, requiring the user to open a hostile file, has limited blast radius and no data compromise. |
| Exploit ScenarioDerived | An attacker crafts a malicious project or asset file and distributes it (e.g., via a shared material library, email, or a compromised asset marketplace) to a user of Adobe Substance 3D Designer. When the victim opens the file, a NULL pointer dereference is triggered and the application crashes, causing a denial-of-service with loss of any unsaved work. No public exploit code was identified at the time of analysis, and the local attack vector with required user interaction limits practical impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Opening a crafted project or asset file in Adobe Substance 3D Designer 16.0.4 and earlier can crash the application, producing a denial-of-service condition on the user's workstation. The defect is a NULL pointer dereference (CWE-476) that is only reachable through mandatory user interaction - the victim must manually open the malicious file - and the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base score 5.5 MEDIUM) confirms the attack is local rather than network-reachable, requires no application credentials, and delivers availability impact only, with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk is limited to an application crash rather than code execution or data compromise.
RemediationAI
No vendor-released patched version is confirmed in the available data; the primary action is to consult Adobe security bulletin APSB26-169 (https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html), which is the authoritative source for the fixed Substance 3D Designer build and upgrade instructions, and to apply that update as soon as it is published - the upstream bulletin is the only reliable place to obtain the exact remediating version rather than relying on the range '16.0.4 and prior' shown in EUVD-2026-100698. Until an update is applied, the most effective control is to treat all .sbs, .sbsar, and related project/asset files from external sources as untrusted: block inbound delivery of these file types at email and web gateways and require that such assets be obtained only from vetted internal sources or reviewed in an isolated environment before opening, accepting the workflow friction this adds for legitimate artist collaboration. Because exploitation requires the victim to open the file (UI:R) and the vector is local (AV:L), running the Designer process in a low-privilege sandbox, container, or dedicated VM limits the blast radius to a crash of an isolated session, at the cost of reduced GPU/hardware acceleration availability and some performance degradation for rendering-heavy work. Enabling operating-system exploit mitigations (DEP/ASLR, SEHOP, and Windows Exploit Protection's exception-handling and heap checks) raises the bar for turning the NULL dereference into a more serious fault, and monitoring endpoint logs for repeated Substance 3D Designer crash reports or access violations can provide early warning of attempted exploitation. Note that no compensating control eliminates the flaw itself, since the crash occurs inside the application's own file parser; patch application remains the only complete fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Substance 3D Designer is a node-based procedural material and texture authoring tool whose native project and asset formats (.sbs projects, .sbsar packaged substances, and related texture/material assets) are parsed locally when a user opens them. The root cause is a NULL pointer dereference (CWE-476): a pointer that is either returned as NULL by a failed memory allocation or file-structure lookup, or left uninitialized during deserialization of a malformed file, is dereferenced without a validity check, resulting in an invalid memory read (typically address 0) and an unhandled access violation that terminates the process. Because the CVSS vector is AV:L with UI:R, the vulnerability is not remotely exploitable - the attacker cannot deliver or trigger it over a network, and the victim must take the explicit action of opening the weaponized file supplied via social engineering. The vector's C:N/I:N/A:H profile, combined with the absence of any reported memory-corruption or code-execution indicators in the available intelligence, frames this strictly as a crash-class availability defect; EUVD-2026-100698 mirrors the same CWE-476 classification and the affected range of Substance 3D Designer 16.0.4 and prior, and the vendor advisory (Adobe APSB26-169, reported by psirt@adobe.com) is the authoritative source for the affected builds.
Know when Substance 3d Designer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File-open trigger makes it local (AV:L) with required user interaction (UI:R); no privileges needed (PR:N), and a crash yields availability-only impact (C:N/I:N/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Substance 3d Designer
View allOut-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability t
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier via an out-of-bounds write vulnerability that trigg
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier through an out-of-bounds write vulnerability that r
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a cr
Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds writ
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability
Exploit-DB