CVE-2026-21338: 
Adobe Substance 3D Designer vulnerability analysis and mitigation

CVE-2026-21338 is a NULL Pointer Dereference vulnerability in Adobe Substance 3D Designer that can cause application-level denial of service. It affects Substance 3D Designer versions 15.1.0 and earlier (all versions prior to 15.1.2). Adobe disclosed and patched this vulnerability on February 10, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring when the application attempts to dereference a null pointer while processing a specially crafted malicious file. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a victim must open a malicious file within the application. There are no known public technical write-ups or proof-of-concept code detailing the precise code path or file format trigger (Adobe Advisory).

Successful exploitation results in an application crash, causing a denial-of-service condition limited to the Substance 3D Designer application. There is no impact on confidentiality or integrity — only availability is affected, and the scope is confined to the local user's session. The vulnerability does not enable code execution, privilege escalation, or lateral movement (Adobe Advisory).

Adobe has released a patch in Substance 3D Designer version 15.1.2, which resolves this vulnerability. Users should update to version 15.1.2 or later immediately via the Creative Cloud desktop application or Adobe's official download channels. As an interim measure, users should avoid opening Substance 3D Designer files from untrusted or unknown sources, and organizations may consider implementing application whitelisting to restrict which files can be opened (Adobe Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Adobe products patched in February 2026, including this issue (CIS Advisory). No significant researcher commentary or notable social media discussion has been identified for this specific CVE, consistent with its medium severity and limited exploitation potential.