CVE-2026-103829: 
Adobe Substance 3D Designer vulnerability analysis and mitigation

CVE-2026-103829 is a NULL Pointer Dereference vulnerability in Adobe Substance 3D Designer that can result in an application-level denial-of-service. An attacker can exploit this vulnerability by tricking a victim into opening a specially crafted malicious file, causing the application to crash. The vulnerability affects Adobe Substance 3D Designer versions 16.0.4 and prior; version 16.0.7 is unaffected. It was published on October 13, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring when the application dereferences a pointer expected to be valid but is NULL during the processing of a malicious file. The attack vector is local, requiring low attack complexity and no privileges, but does require user interaction — specifically, a victim must open a crafted file. No technical write-ups or public proof-of-concept code detailing the precise code path or file format trigger have been identified at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation results in an application crash, causing a denial-of-service condition for the affected user. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability of the Substance 3D Designer application. Because the scope is unchanged and the attack is local, there is no direct risk of lateral movement or sensitive data exposure (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept for CVE-2026-103829. The NVD SSVC assessment confirms exploitation is classified as "none" and the vulnerability is not automatable. The EPSS score is approximately 0.138% (3rd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Adobe Advisory).

Adobe has released Substance 3D Designer version 16.0.7 to address this vulnerability; users running version 16.0.4 or earlier should update immediately. As a precautionary measure, users should avoid opening Substance 3D Designer files received from untrusted or unknown sources. Implementing file validation controls or application sandboxing can provide additional defense-in-depth where upgrading is not immediately possible (Adobe Advisory).