EUVD-2026-100702
GHSA-wvm4-vmv4-5cqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Substance 3D file
-
DeliveryDeliver file to victim user
-
ExploitVictim opens file in Designer
-
ExecutionNULL pointer dereference triggers
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to deliver a specially crafted malicious file and a victim to actively open that file in Adobe Substance 3D Designer version 16.0.4 or earlier; the flaw is local (AV:L) and cannot be triggered remotely without this user interaction (UI:R). No authentication is required of the attacker (PR:N), but the mandatory victim action of opening an untrusted file - plus the local-only vector and the limitation to application crash with no code execution or data impact - substantially constrains real-world risk to targeted social-engineering or supply-chain asset-delivery situations. |
| Impact | This is a moderate-severity, low-priority issue despite being network-labeled nowhere - the CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly reflects a local, user-interaction-dependent denial-of-service with no confidentiality or integrity impact, consistent with the CWE-476 NULL pointer dereference and the description's requirement that a victim open a malicious file. The 5.5 base score is driven entirely by the high availability impact (application crash); there is no code execution or data exposure. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so all three exploitation-likelihood signals are either absent or negative. The signals are internally consistent - a file-parsing crash in a desktop authoring tool is a realistic but low-urgency problem, not a widespread remote threat. Missing data to note: no EPSS probability is available to gauge real-world exploitation interest. |
| Exploit ScenarioDerived | An attacker crafts a malicious Substance 3D Designer project or asset file and delivers it to a victim via email, a shared asset repository, or a compromised marketplace download. When the victim opens the file in Substance 3D Designer, a NULL pointer dereference is triggered and the application crashes, causing loss of unsaved work and a denial-of-service condition. No public exploit code is referenced at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Application denial-of-service in Adobe Substance 3D Designer 16.0.4 and earlier, where a NULL pointer dereference (CWE-476) triggers a crash when the application processes a specially crafted file. Exploitation requires a victim to actively open a malicious asset, so the attack is local in nature (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) - no attacker authentication is required, but the mandatory user action and the local vector sharply limit reachability to targeted social-engineering or supply-chain delivery of poisoned project files. Impact is limited to availability: there is no confidentiality or integrity loss and no evidence of code execution. There is no public exploit identified at time of analysis, and exploitation is not confirmed actively exploited (CISA KEV); overall this is a moderate-severity, low-priority issue best handled through routine patching of the affected build.
RemediationAI
Patch available per vendor advisory: install the fixed Adobe Substance 3D Designer release described in Adobe security bulletin APSB26-169 (https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html), which supersedes the affected 16.0.4-and-earlier builds - apply it to every workstation running Designer before handling externally sourced materials. Where immediate upgrade is not possible, reduce exposure by treating all inbound Substance project and material files (.sbs, .sbsar, and related asset bundles) as untrusted: strip or quarantine these attachments at the email and file-transfer gateway, require assets to be sourced from vetted vendors or internal repositories, and open unknown files only on an isolated or disposable workstation so that a crash cannot interrupt production work. Additional low-cost controls include enabling application crash monitoring/EDR alerting on the Designer process to detect repeated crash-on-open events, restricting untrusted users from opening third-party asset packs on shared render or build nodes, and keeping the authored asset pipeline read-only for non-owners. The trade-off of file-type blocking at the gateway is friction for legitimate vendor asset delivery and should be scoped to external senders, while sandboxed review adds manual triage effort; none of these mitigations prevent the crash itself, they only contain its blast radius, so the vendor patch remains the primary fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a NULL pointer dereference (CWE-476) in Adobe Substance 3D Designer, a procedural material and texture authoring tool used widely in game, film, and product-visualization pipelines. In this class of bug, the application follows a pointer that the parser or downstream processing routine failed to initialize or validate - typically because a crafted input file omits or malforms a field the code assumes is present - and the resulting dereference of address 0 terminates the process rather than yielding memory corruption. Because the crash maps to a pure availability impact, the assessed CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H: the vector is local, the complexity is low once the file is delivered, no privileges are needed by the attacker (PR:N), but the victim must open the malicious file (UI:R), and the scope remains unchanged with no C/I effect. The CWE-476 classification and the Adobe PSIRT attribution are consistent with a file-parsing robustness defect rather than a remotely reachable, unauthenticated service flaw; the affected package is identified in EUVD as Substance 3D Designer 16.0.4 and prior.
Know when Substance 3d Designer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file must be opened by the user, so AV:L and UI:R; no attacker privileges needed (PR:N); crash-only yields A:H with C:N/I:N.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Substance 3d Designer
View allOut-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Arbitrary code execution in Substance 3D Designer 15.0.3 and earlier results from an out-of-bounds write vulnerability t
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier via an out-of-bounds write vulnerability that trigg
Arbitrary code execution in Substance 3D Designer 15.1.0 and earlier through an out-of-bounds write vulnerability that r
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could resul
Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a cr
Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds writ
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability
Exploit-DB