CVE-2026-103828: 
Adobe Substance 3D Designer vulnerability analysis and mitigation

CVE-2026-103828 is a NULL Pointer Dereference vulnerability in Adobe Substance 3D Designer that can result in an application-level denial-of-service. An attacker can exploit this vulnerability by crafting a malicious file that, when opened by a victim, causes the application to crash. All versions up to and including 16.0.4 are affected; version 16.0.7 and later are unaffected. The vulnerability was published on October 13, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring when the application dereferences a pointer expected to be valid but is NULL during the processing of a specially crafted file. The attack vector is local, requiring low complexity and no privileges, but does require user interaction — specifically, a victim must open a malicious file. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation results in an application crash, causing a denial-of-service condition for the affected user. There is no impact on confidentiality or integrity — only availability is affected, and the scope is limited to the Substance 3D Designer application process itself. Lateral movement or data exfiltration are not associated with this vulnerability (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept for this vulnerability. The EPSS score is approximately 0.138% (3rd percentile), indicating a low probability of exploitation within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment confirms no known exploitation (GitHub Advisory, Adobe Advisory).

1. Craft a malicious file: Create a specially crafted Substance 3D Designer project or asset file designed to trigger a NULL pointer dereference during parsing or rendering.
2. Social engineering delivery: Distribute the malicious file to a target user via email, file-sharing platform, or other means, convincing them to open it with Substance 3D Designer.
3. Trigger the vulnerability: When the victim opens the malicious file in an affected version (≤16.0.4), the application attempts to dereference a NULL pointer during file processing.
4. Application crash: The NULL pointer dereference causes an unhandled exception, crashing the Substance 3D Designer application and resulting in a denial-of-service condition for the user (GitHub Advisory, Adobe Advisory).

• File System: Presence of unexpected or unsolicited Substance 3D Designer project files (e.g., .sbs, .sbsar) received from unknown or untrusted sources.
• Logs: Application crash logs or Windows Error Reporting (WER) entries referencing Substance3DDesigner.exe with access violation or null pointer exception codes (e.g., exception code 0xC0000005).
• Process: Unexpected termination of the Substance3DDesigner.exe process shortly after opening a file, particularly files received externally.

Adobe has released Substance 3D Designer version 16.0.7 to address this vulnerability; all users running version 16.0.4 or earlier should update immediately (Adobe Advisory). As a workaround, users should avoid opening Substance 3D Designer files from untrusted or unknown sources. Organizations may also consider implementing file validation controls or user awareness training to reduce the risk of social engineering attacks delivering malicious files.