CVE-2026-27217: 
Adobe Substance 3D Painter vulnerability analysis and mitigation

CVE-2026-27217 is a NULL Pointer Dereference vulnerability in Adobe Substance 3D Painter that can cause application denial-of-service. It affects Substance 3D Painter versions 11.1.2 and earlier, with version 11.1.3 introducing the fix. The vulnerability was disclosed on March 10, 2026, as part of Adobe's March 2026 security update (APSB26-25). It carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring when the application attempts to dereference a null pointer during the processing of a specially crafted file. The attack vector is local, requiring low attack complexity and no privileges, but does require user interaction — specifically, a victim must open a malicious file. No public technical write-ups or proof-of-concept code have been identified for this vulnerability (Adobe Advisory).

Successful exploitation results in an application crash, causing a denial-of-service condition for the affected user. There is no impact on confidentiality or integrity — only availability is affected, limited to the scope of the Substance 3D Painter application on the victim's system. Lateral movement or data exfiltration are not associated with this vulnerability (Adobe Advisory).

Adobe has released Substance 3D Painter version 11.1.3, which addresses this vulnerability. Users should update to version 11.1.3 or later as the primary remediation step. As an interim measure, users should be advised to avoid opening files from untrusted or unknown sources, and organizations should implement file access controls where feasible (Adobe Advisory).

The CIS (Center for Internet Security) published an advisory noting multiple vulnerabilities in Adobe products patched in March 2026, including this issue. Coverage was otherwise limited to automated vulnerability tracking platforms such as VulnDB, CVEFeed, and Tenable's plugin pipeline, with no notable researcher commentary or significant community discussion identified (CIS Advisory).