CVE-2026-27214: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-27214 is a NULL Pointer Dereference vulnerability in Adobe Substance 3D Painter that can cause application-level denial of service. It affects Substance 3D Painter versions 11.1.2 and earlier. Adobe disclosed and patched this vulnerability on March 10, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring when the application attempts to dereference a null pointer during the processing of a specially crafted file. The attack vector is local, requiring low attack complexity and no privileges, but does require user interaction — specifically, a victim must open a malicious file. No public proof-of-concept or detailed technical write-up has been identified at this time (Adobe Advisory).

Successful exploitation results in an application crash, causing a denial-of-service condition for the affected Substance 3D Painter instance. There is no impact on confidentiality or integrity — only availability is affected. The scope is limited to the local application and does not facilitate lateral movement or data exfiltration (Adobe Advisory).

Adobe has released a patch addressing this vulnerability in Substance 3D Painter version 11.1.3. Users should update to version 11.1.3 or later as the primary remediation step. As an additional precaution, users should be advised not to open Substance 3D Painter files received from untrusted or unknown sources (Adobe Advisory).

The vulnerability was noted in a CIS advisory covering multiple Adobe product vulnerabilities released in March 2026, which highlighted the broader patch batch rather than this specific CVE. Coverage has been limited to automated vulnerability tracking platforms and security aggregators, with no notable researcher commentary or significant community discussion identified (CIS Advisory).