CVE-2026-21364: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-21364 is a NULL Pointer Dereference vulnerability in Adobe Substance 3D Painter that can cause application denial-of-service. It affects Substance 3D Painter versions 11.1.2 and earlier. Adobe disclosed and patched this vulnerability on March 10, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring when the application attempts to dereference a null pointer during file parsing or processing. Exploitation requires a local attack vector and user interaction — specifically, a victim must open a specially crafted malicious file. No elevated privileges are required for the attacker to deliver the malicious file, but the victim must be socially engineered into opening it (Adobe Advisory).

Successful exploitation results in an application crash, causing a denial-of-service condition for the affected Substance 3D Painter instance. There is no impact on confidentiality or integrity — only availability is affected. The scope is limited to the local application and does not facilitate lateral movement or data exfiltration (Adobe Advisory).

1. Craft malicious file: An attacker creates a specially crafted project or asset file (e.g., a Substance Painter project file) designed to trigger a null pointer dereference during parsing.
2. Deliver the file: The attacker distributes the malicious file to a target user via email, file-sharing platforms, or other social engineering methods.
3. Victim opens the file: The victim opens the malicious file in Adobe Substance 3D Painter version 11.1.2 or earlier.
4. Trigger crash: The application attempts to dereference a null pointer during file processing, causing an unhandled exception and application crash, resulting in denial-of-service (Adobe Advisory).

• File System: Presence of unexpected or unsolicited Substance 3D Painter project files (e.g., .spp files) received from unknown or untrusted sources.
• Logs: Application crash logs or Windows Event Viewer entries showing Substance 3D Painter process termination with access violation or null pointer exception errors.
• Process: Repeated unexpected termination of the Substance 3D Painter process shortly after opening a specific file.

Adobe has released Substance 3D Painter version 11.1.3 to address this vulnerability. Users should upgrade to version 11.1.3 or later as the primary remediation. As an additional precaution, users should avoid opening Substance 3D Painter files received from untrusted or unknown sources, and organizations should implement controls to restrict access to untrusted files (Adobe Advisory).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in Adobe products patched in March 2026, including this issue, flagging potential for service disruption. Coverage was otherwise limited to standard vulnerability aggregation platforms such as VulnDB, CVEfeed, and Tenable plugin tracking, with no notable researcher commentary or significant social media discussion observed.