CVE-2026-21340 is an out-of-bounds read vulnerability in Adobe Substance3D - Designer (versions 15.1.0 and earlier). Exploitation requires a user to open a malicious file, which could cause the application to read memory beyond its intended bounds, potentially exposing sensitive information. The vulnerability affects confidentiality but not integrity or availability. No known exploits are reported in the wild. The CVSS 3.1 vector indicates low attack complexity, no privileges required, but user interaction is necessary.

Successful exploitation can lead to disclosure of sensitive information stored in memory of the affected application. There is no impact on system integrity or availability. The vulnerability requires user interaction, limiting the attack vector to scenarios where a user opens a crafted file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted files with Adobe Substance3D - Designer. Monitor Adobe's security advisories for updates regarding patches or mitigations.