Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated, low-privileged code execution on a host to trigger a use-after-free in the installer service and execute code in a higher-privileged context. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-416), the flaw requires an existing foothold and is therefore a second-stage escalation primitive rather than a remotely reachable or pre-authentication vector, with no user interaction needed once that local access exists. No public exploit code has been identified at time of analysis, and no confirmed active exploitation has been reported; Microsoft has released fixes covering all supported Windows client and server branches, including fixed builds such as 10.0.26100.9711 for Windows 11 24H2 and 10.0.26100.33650 for Windows Server 2025.
Local privilege escalation in Windows Management Services lets an authenticated attacker who already holds a standard-user session on a Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 host drive a use-after-free to gain high-integrity code execution with full confidentiality, integrity, and availability impact on the affected machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is only reachable after the attacker has obtained local code execution, making it a post-compromise escalation primitive rather than a remote entry point; the CISA SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis. A vendor patch is available through Microsoft's update guide, and the impact is total for the host once the UAF is successfully converted into elevation.
Local privilege escalation in the Windows Print Spooler allows an attacker who already holds an authenticated, low-privileged foothold on a Windows host to elevate to SYSTEM-level code execution. The root cause is a use-after-free memory corruption flaw (CWE-416) that requires no user interaction and has low attack complexity, so it can be triggered reliably once local code execution is obtained; the local-only vector means it is a post-compromise escalation primitive rather than an initial-access path. Microsoft has released patched builds for all affected client and server versions, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based memory corruption in the Windows Remote Access Connection Manager (RasMan) service lets a locally authenticated, low-privileged user corrupt heap memory and escalate privileges into the service's elevated security context on affected Windows 10, Windows 11 and Windows Server builds. The path is purely local and requires an existing foothold with standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), and CISA's SSVC rates exploitation as none with non-automatable attacks but total technical impact. There is no public exploit identified at time of analysis, and Microsoft has released fixed builds, so this is a credible but not emergency-tier priority - highest for hosts where untrusted or semi-trusted users already have interactive local access.
Local privilege escalation in the Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privilege attacker with an existing foothold on the host to trigger a use-after-free in the queue manager and elevate to SYSTEM (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, requires MSMQ - an optional Windows component that is not installed or running by default - and provides no path to initial access, so the realistically exposed population is limited to hosts where MSMQ is enabled and to attackers who have already obtained a local account. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a vendor patch; the risk is credible but not a drop-everything emergency.
A stack-based buffer overflow (CWE-121) in the Windows Installer component (msiexec/MSI package processing) allows an authenticated local attacker holding a low-privileged session to elevate to higher privileges, including SYSTEM, with high confidentiality, integrity, and availability impact (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable in the default configuration of all supported Windows client and server editions, but exploitation requires an existing local foothold and no victim interaction, so it is best characterized as a privilege-escalation link in a broader intrusion chain rather than an initial-access vector. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as total. A vendor patch is available per Microsoft's MSRC update guide.
Local privilege escalation in the Windows Clipboard User Service lets an authenticated low-privileged attacker who can already run code on a target host raise their rights to SYSTEM-level by triggering a use-after-free in the service's memory handling. Exploitation is timing-sensitive rather than trivial: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker needs local authenticated access and must win a race to reclaim freed memory, but no victim interaction and no network path are required, and the resulting scope change means full compromise of confidentiality, integrity, and availability on the host. Microsoft has released fixed builds for all affected Windows branches, and as of analysis there is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); this is a moderate-priority, real-but-not-urgent elevation-of-privilege flaw that matters most on multi-user, RDP, or kiosk-style systems where untrusted users share a session host.
Local privilege escalation in the Windows Clipboard User Service allows an authenticated low-privileged attacker who already holds a foothold on the host to elevate to higher integrity via a use-after-free (CWE-416) in the service's object handling. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and because the Scope metric is Changed the successful exploit crosses a privilege boundary rather than merely corrupting the vulnerable process. Exploitation is constrained by high attack complexity - the attacker must win a timing window and reliably reclaim the freed object, so CISA's SSVC assessment rates it non-automatable with exploitation observed as none, and no public exploit code has been identified at time of analysis. All supported Windows 10, Windows 11 and Windows Server branches up to the January-class build cutoffs listed in the advisory are affected, and a vendor patch is available.
Local privilege escalation in the Internet Explorer/MSHTML engine affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) as enumerated by EUVD. An attacker who already holds low-privileged local access on the host (PR:L, AV:L) and requires no user interaction (UI:N) can trigger a use-after-free (CWE-416) in the freed-component path to cross a security boundary and gain higher privileges, with the scope change (S:C) indicating the compromise escapes the original security context; C/I/A impacts are all High. Exploitation is constrained by high attack complexity (AC:H), which in practice means winning a memory-timing race and successfully grooming the heap to reclaim the freed object - there is no public exploit identified at time of analysis, SSVC assessed exploitation as 'none' and automatable as 'no', and no CISA KEV entry exists. Risk is genuine but non-emergency: the limiting factors are the prerequisite local foothold and the unreliable, complexity-bound trigger rather than any non-default configuration.
Local privilege escalation in OpenSSH for Windows allows an authenticated attacker to elevate privileges by triggering a double-free memory corruption. Affected builds include Windows 10, Windows 11, and Windows Server versions prior to the fixed builds listed in Microsoft's advisory. No public exploit identified at time of analysis; a vendor-released patch is available.
Privilege escalation in Microsoft Exchange Server allows an authenticated local attacker to gain elevated privileges on the server. The vulnerability, tracked as CVE-2026-87695, affects Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition RTM before specific patched builds. Exploitation requires the attacker to already have low-privileged access on the Exchange server itself (CVSS PR:L, AV:L), which significantly limits the attack surface; no public exploit has been identified at time of analysis. A vendor patch is available.
Ivanti Xtraction versions prior to 2026.4 are vulnerable to a path traversal flaw in the template export feature, allowing an authenticated attacker with low privileges to read arbitrary files accessible to the service account. Exploitation requires a valid session but no user interaction, and while confidentiality is compromised, no public exploit code or active exploitation has been identified; this is a genuine but second-tier priority rather than an emergency.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.
Local privilege elevation on supported Windows builds stems from the Windows Key Distribution Center (KDC) accepting cryptographic signatures it should have rejected, letting an attacker who already holds low-privileged credentials and local access to an affected host reach high integrity and confidentiality impact (CVSS 7.8, AV:L/PR:L/UI:N). The KDC role normally runs only on Windows Server Domain Controllers, although the vulnerable code ships across every client and server build enumerated in the EUVD data - Windows 10 1607/1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025. Microsoft has published a fix through the MSRC update guide; no public exploit code and no CISA KEV entry were identified at time of analysis, and the independent assessment rates this as a genuine but second-tier priority because exploitation requires a pre-existing foothold and validated credentials rather than a remote or unauthenticated path.
Arbitrary code execution in Adobe Photoshop Desktop (27.x up to and including 27.10, and 26.x up to and including 26.11.7) is possible when a user opens a specially crafted file, because an integer overflow or wraparound during file parsing corrupts memory and lets attacker-controlled code run in the context of the current user. Exploitation is local in nature - the attacker must deliver a malicious file and convince the victim to open it - and, per the CVSS vector (AV:L, PR:N, UI:R, S:U), no prior authentication is needed but no privilege escalation is gained, since code executes only with the victim's own rights. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is a credible but not top-tier priority driven by targeted social engineering rather than opportunistic mass exploitation.
Integer overflow (CWE-190) in Adobe Photoshop Desktop lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Affected installations are Photoshop 27.x up to and including 27.10 and Photoshop 26.x up to and including 26.11.7, per Adobe advisory APSB26-158 (tracked as EUVD-2026-100691). The vector is local (AV:L) and unauthenticated (PR:N) but gated by mandatory user interaction (UI:R), so there is no network-facing, no-click exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority client-side file-parsing flaw rather than a mass-exploitation emergency.
Opening a maliciously crafted file in Adobe Photoshop Desktop (27.10 and earlier, and 26.11.7 and earlier) can trigger a double-free memory-corruption condition that results in arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker cannot reach the target over the network and must rely on the victim opening the file, and that code executes only with the privileges of the logged-on user rather than escalating to system level; adversary value is therefore tied to social-engineering delivery of a weaponised document, and there is no public exploit identified at time of analysis. The independent assessment rates this as a credible but not emergency-level priority, consistent with the local attack vector and user-interaction requirement; no CISA KEV listing or public proof-of-concept was supplied in the source data.
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Out-of-bounds write in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens an attacker-crafted document. Rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787), the flaw is reached locally and requires user interaction, so exploitation depends on social engineering to deliver a malicious file that the target then opens; no authentication is required of the attacker and no non-default configuration is implicated, meaning any installation that opens the file is affected. Impact is bounded by the privileges of the user running FrameMaker (S:U), and there is no public exploit code or confirmed active exploitation identified at time of analysis.
An out-of-bounds write (CWE-787) in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens a crafted FrameMaker document. Exploitation is file-based and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 7.8 HIGH): the attacker must socially engineer the target into opening malicious content, and the resulting code runs with only that user's privileges rather than gaining system-level control. No confirmed active exploitation or publicly available exploit code was identified at time of analysis, but the full confidentiality, integrity, and availability impact makes prompt patching important for engineering and technical-publishing environments that routinely exchange FrameMaker files.
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
Opening an attacker-supplied crafted file in Adobe Dimension 4.1.8 or earlier can trigger a stack-based buffer overflow that allows arbitrary code execution in the context of the victim's user account. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is delivered purely through social engineering - a target must open a malicious file - and requires no network reachability, credentials, or elevated privileges, though any resulting code runs only at the victim's privilege level with no scope change. No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a credible but moderate-priority patching item rather than an emergency.
Heap-based buffer overflow in Adobe FrameMaker enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted file. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) confirms the attack is local and requires user interaction, with no privileges needed to trigger the flaw but no remote or automatable path either. No public exploit was identified at time of analysis, exploitation is bounded to systems where FrameMaker is installed and used to open untrusted documents, and code runs only with the current user's privileges - there is no automatic elevation of privilege.
Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.
Out-of-bounds write in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious file. The vulnerability requires user interaction (opening the file) and has a local attack vector, with a CVSS 3.1 base score of 7.8 High. No public exploit code has been identified at time of analysis.
Opening an attacker-supplied file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds write that leads to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is strictly local and client-side: there is no network-facing service to hit, and the victim must be socially engineered into opening a malicious asset in their own session. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the practical risk is bounded by the required user interaction and the specialized deployment of this creative tooling, which favors targeted delivery over opportunistic mass exploitation.
Local privilege escalation in Windows Credential Providers allows an attacker who already holds authenticated low-privileged access on a host to trigger a race condition in concurrently accessed shared resources and escalate privileges. Exploitation is complicated by a high attack-complexity rating (AC:H) - the attacker must repeatedly invoke the credential provider code path and win a narrow, non-deterministic timing window, so success is probabilistic rather than reliable. There is no remote or unauthenticated vector and no user-interaction requirement (AV:L, PR:L, UI:N, S:C), and no public exploit code or confirmed active exploitation was identified at time of analysis; risk is concentrated on multi-user, shared, or already-foothold Windows systems rather than single-user desktops without untrusted local access.
Arbitrary code execution in Adobe Substance 3D Stager (versions 3.1.8 and earlier) is possible when a victim opens a maliciously crafted file, which overflows a stack buffer during parsing and lets the malformed input corrupt memory in the context of the current user. The attack cannot be triggered remotely or without the target's cooperation - it is a local vector (AV:L) that requires user interaction (UI:R), so delivery depends on social engineering that convinces the victim to open the file - and code executes with the privileges of that user only (S:U), meaning a non-administrative victim limits the blast radius to that account. Adobe's PSIRT assigned a 7.8 base score (CWE-121), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Opening a crafted file in Adobe Substance 3D Stager 3.1.8 or earlier can trigger a stack-based buffer overflow that leads to arbitrary code execution in the context of the current user. The attack is local in nature (AV:L) and requires the victim to open an attacker-supplied file (UI:R), while requiring no privileges on the target (PR:N), so practical exploitation depends on socially engineering a user into opening a malicious asset rather than on any remotely reachable network service. There is no public exploit identified at time of analysis and nothing in the supplied intelligence indicates confirmed active exploitation, so this is a genuine but not emergency-priority issue at a CVSS 3.1 base score of 7.8, with impact bounded by the privileges of the user who opens the file.
Arbitrary code execution is possible in Adobe Substance 3D Stager 3.1.8 and earlier, where a use-after-free (CWE-416) is triggered while the application processes a crafted file. The CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) shows no authentication is required, but the attacker must deliver the malicious file locally and convince the victim to open it, after which code runs only with the privileges of the current user. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the practical risk is driven by social-engineering delivery and by the fact that a crash (denial of service) is also achievable from the same corrupting file.
Arbitrary code execution in mp4v2 2.0.0 can be triggered when a victim or application opens a specially crafted MP4 file containing an undersized RTP ('rtp ') atom; MP4RtpAtom::ReadHntiType() performs an unchecked offset subtraction that underflows to a near-2^64 allocation size, leading to memory corruption and potential code execution. The assessed vector is local with user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so the malicious file must be parsed on the target system rather than delivered to a listening network service. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile), and the upstream fix is available as a PR/commit but no released patched version is independently confirmed.
An out-of-bounds read when parsing a crafted file in Adobe Substance 3D Stager 3.1.8 and earlier can be leveraged to execute code in the context of the current user, though exploitation is constrained by mandatory user interaction - a victim must open a maliciously crafted file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is triggered locally through file loading rather than over the network, requires no attacker-held privileges, and yields only the privileges of the user who opens the document. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a genuine but not emergency-grade priority requiring timely patching rather than urgent incident response.
Parsing a maliciously crafted 3D asset or project file in Adobe Substance 3D Stager 3.1.8 and earlier can drive an out-of-bounds read that leads to code execution in the context of the user running the application. Exploitation is local and socially engineered - the victim must open the attacker-supplied file (AV:L, UI:R, PR:N) - and impact is confined to that user's privileges (S:U), so a non-administrative account limits the blast radius. No public exploit code and no CISA KEV entry were identified at time of analysis, making this a targeted, per-user risk rather than a mass-exploitation threat.
An out-of-bounds read (CWE-125) in Adobe Substance 3D Stager 3.1.8 and earlier can lead to arbitrary code execution in the context of the current user when a victim opens a crafted file with the application. Exploitation is local in vector terms (AV:L) and requires user interaction (UI:R), so an attacker must first deliver a malicious asset and persuade the target to open it; code execution is confined to the victim's privileges because the scope is unchanged (S:U). Rated CVSS 7.8 (High), with no public exploit identified at time of analysis and no CISA KEV listing, making this a genuine but not top-tier priority that should be handled through routine patch cycles rather than emergency response.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is possible when a low-privileged authenticated attacker with local or adjacent access exploits an incorrect authorization flaw (CWE-863) to operate outside the intended security scope and run code in the context of the current user. Adobe notes the exploit depends on conditions beyond the attacker's control, which is reflected in the high attack complexity (AC:H), and no user interaction is required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the combination of authenticated low privilege (PR:L), local vector (AV:L) and high complexity makes reliable mass exploitation unlikely.
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.
An out-of-bounds write (CWE-787) in Adobe Dimension 4.1.8 and earlier allows arbitrary code execution at the privilege level of the user who opens a specially crafted file, such as a malicious Dimension project or imported 3D asset. Exploitation is local and depends entirely on victim interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) - the attacker must deliver a file the user then opens, so this is not a remotely triggerable, wormable flaw; no public exploit code identified at time of analysis and the CVE is not in CISA KEV. The practical risk is genuine but operationally constrained by the mandatory user action, the local delivery requirement, and the shrinking installed base of what our assessment describes as a discontinued product.
Out-of-bounds write in Adobe Bridge (versions up to and including 15.1.8 and 16.0.7) can let an attacker execute arbitrary code in the context of the current user when a crafted file is opened. The attack is local and requires the victim to open a malicious file (UI:R), so delivery of the file to the target and a user action are both prerequisites; no authentication is required of the attacker and complexity is low once the file is opened. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the vendor advisory (APSB26-167) is the authoritative fix reference. Given the mandatory user interaction and local delivery requirement, this is a credible but second-tier priority rather than an urgent remotely exploitable issue.
Out-of-bounds write in Adobe Bridge allows a local attacker to achieve arbitrary code execution in the context of the current user when a victim opens a malicious file. Affected versions are Adobe Bridge 15.1.8 and earlier, and 16.0.7 and earlier. Exploitation requires user interaction (opening a crafted file) and no elevated privileges, but the attack is local. No public exploit code has been identified at time of analysis, and the flaw is rated CVSS 7.8, making it a legitimately actionable local code-execution flaw but not a drop-everything emergency.
Out-of-bounds write in Adobe Bridge - versions 15.x through 15.1.8 and 16.x through 16.0.7 - can result in arbitrary code execution in the context of the current user when a victim opens or previews a crafted file. The issue is local in reach (AV:L) and requires attacker-induced user interaction (UI:R), with no authentication or elevated privileges needed (PR:N) and low attack complexity (AC:L) once the file is opened, yielding a CVSS 3.1 base score of 7.8. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical barrier for an attacker remains the social engineering needed to convince a target on an unpatched version to open the malicious file.
Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.
Arbitrary code execution in Adobe Substance 3D Stager 3.1.8 and earlier is possible via an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, such as a 3D asset or project file, in the application. The flaw carries a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is local-only with no network path, requires victim user interaction to open the file, and needs no prior privileges, but grants full confidentiality, integrity, and availability impact through code execution in the context of the current user. There is no public exploit identified at time of analysis (not in CISA KEV, no POC referenced), so the practical risk depends on an attacker's ability to socially engineer a designer or artist into opening a booby-trapped asset.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local, user-interaction-required flaw (CVSS 7.8) stems from improper memory handling (CWE-787) during file/asset parsing; no public exploit code has been identified at time of analysis, and exploitation requires the attacker to deliver a crafted file to the target workstation. Successful exploitation grants code execution with the privileges of the Stager user, with high impact to confidentiality, integrity, and availability.