#202020

Adobe Security Bulletin

Last updated on Feb 10, 2026

Security updates available for Substance 3D Modeler | APSB26-08

Bulletin ID
Date published
Priority
APSB26-08
January 13, 2026
3
style
grid width 12

Summary

Adobe has released an update for Adobe Substance 3D Modeler. This update addresses critical and important vulnerabilities in Adobe Substance 3D Modeler. Successful exploitation could lead to arbitrary code execution, memory exposure, and application denial-of-service.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product
Version
Platform
Adobe Substance 3D Modeler
1.22.4 and earlier versions
All
style
grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app's update mechanism. For more information, please reference this help page.

Product
Version
Platform
Priority
Availability
Adobe Substance 3D Modeler
1.22.5
All
3
Download Center
style
grid width 12

Note

For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.

style
xl spacing, one up, grid width 8, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-21298
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21299
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21300
Vulnerability category: NULL Pointer Dereference (CWE-476)
Vulnerability impact: Application denial-of-service
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2026-21301
Vulnerability category: NULL Pointer Dereference (CWE-476)
Vulnerability impact: Application denial-of-service
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2026-21302
Vulnerability category: Out-of-bounds Read (CWE-125)
Vulnerability impact: Memory exposure
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2026-21303
Vulnerability category: Out-of-bounds Read (CWE-125)
Vulnerability impact: Memory exposure
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Acknowledgments

Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:

  • voidexploit -- CVE-2026-21298, CVE-2026-21299, CVE-2026-21300, CVE-2026-21301, CVE-2026-21302, CVE-2026-21303

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle
APSB26-08
CardDescription
Priority 3 Security update
CardImage
Adobe
Created
2026-01-13
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/substance-3d-modeler
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/substance-3d-modeler
Arbitrary
search: CVE-2026-21298 CVE-2026-21299 CVE-2026-21300 CVE-2026-21301 CVE-2026-21302 CVE-2026-21303