CVE-2026-21340 Details
Description
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
A vulnerability allowing out-of-bounds read has been identified in Adobe Substance 3D Designer, affecting versions through 15.1.0. This vulnerability could lead to memory exposure, allowing an attacker to disclose sensitive information stored in memory. Exploitation requires user interaction, as a victim must open a malicious file.
Users are advised to update to Adobe Substance 3D Designer version 15.1.2. For managed environments, IT administrators can deploy this update using the Adobe Admin Console.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://helpx.adobe.com/security/products/substance3d_designer/apsb26-19.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| adobe substance 3d designer | < 15.1.2 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 28, 2026 | CVE Modified | [email protected] |
| Aug 27, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Modified Analysis | [email protected] |
| Apr 28, 2026 | CVE Modified | [email protected] |
| Feb 11, 2026 | Initial Analysis | [email protected] |
| Feb 10, 2026 | New CVE Received | [email protected] |