Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Substance3D Designer versions 15.1.0 and earlier can leak sensitive memory data

CVE-2026-21340 · published 8 months ago
Summary

If you use Substance3D Designer version 15.1.0 or earlier, an attacker could trick you into opening a malicious file, which could reveal confidential information stored in your memory. This is a serious issue, as sensitive data could be compromised. Update to the latest version to fix this issue.

What to do
  • Update adobe substance_3d_designer to version 15.1.2 or later.
Affected software
VendorProductAffected versions
adobe substance_3d_designer < 15.1.2
cpe:2.3:a:adobe:substance_3d_designer:*:*:*:*:*:*:*:*
adobe adobe substance 3d designer <= 15.1.1
Original advisory text
Substance3D - Designer | Out-of-bounds Read (CWE-125)
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published10 Feb 2026
Updated3 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-21340 · NVD
CVE-2026-21340 · MITRE
Track software like this
Free during beta