Adobe Bridge
CVE-2025-54268
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious file to victim
-
ExploitVictim opens file in Adobe Bridge
-
ExecutionTrigger heap buffer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted malicious file within Adobe Bridge (versions 14.1.8, 15.1.1 and earlier) - this user interaction (UI:R) is the primary limiting factor and means the flaw cannot be triggered remotely or automatically. Although PR:N indicates no prior authentication is needed, the AV:L vector means the malicious file must be processed locally by the victim's Bridge installation. Code execution is confined to the privileges of the current user (S:U), so an attacker would need a separate privilege-escalation step to gain system-level control. There is no network-facing service or default-on remote feature involved; realistic risk therefore depends on an attacker's ability to socially engineer file delivery and opening. |
| Impact | This is a moderate-priority vulnerability that is genuinely rated rather than inflated: the CVSS 3.1 base score of 7.8 (HIGH) is driven entirely by the impact metrics (C:H/I:H/A:H) and NOT by ease of exploitation. The vector AV:L/AC:L/PR:N/UI:R confirms this is a local, user-interaction-dependent flaw - an attacker cannot reach it remotely over a network; a victim must be socially engineered into opening a malicious file in Adobe Bridge. EPSS is low at 0.27% (17th percentile), which is consistent with a client-side file-parsing bug that depends on user action and has no public exploit. The vulnerability is NOT on the CISA KEV list and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. The signals are mutually consistent (low EPSS + no KEV + UI:R + AV:L all point to opportunistic phishing-style abuse rather than mass exploitation), so there is no conflict to flag. Note one minor caveat: the only reference points to Adobe advisory APSB25-96, while Adobe's own CVE naming for Bridge heap-overflow issues sometimes spans multiple bulletins - verify the exact fixed build against the linked advisory. |
| Exploit ScenarioDerived | An attacker crafts a malicious file (e.g., a specially-formed image or document that Bridge will parse) and delivers it to a victim via email, download, or a shared asset library. When the victim opens the file in Adobe Bridge, a heap-based buffer overflow (CWE-122) is triggered, allowing arbitrary code execution in the context of the logged-in user. No public exploit code is referenced, and successful exploitation requires the victim to actively open the attacker-supplied file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Heap-based buffer overflow in Adobe Bridge 14.1.8, 15.1.1 and earlier allows arbitrary code execution in the context of the current user when a victim opens an attacker-crafted file. The flaw carries a CVSS 3.1 base score of 7.8 (HIGH) but its impact metrics (C:H/I:H/A:H) drive that score, not ease of exploitation: triggering it requires user interaction (UI:R) and local processing of a malicious file (AV:L), and there is no network-facing service involved. No public exploit code and no confirmed active exploitation have been identified - EPSS is 0.27% (17th percentile) and the CVE is not in CISA KEV - so realistic risk depends on social engineering a user into opening a malicious document. A vendor advisory with patched versions is available (Adobe APSB25-96).
RemediationAI
Apply the update referenced by the vendor advisory: Adobe published APSB25-96 (https://helpx.adobe.com/security/products/bridge/apsb25-96.html) covering this issue, and the advisory is the authoritative source for the exact patched build numbers for the 14.x and 15.x branches - the fixed version is not specified in the data provided here, so confirm the specific release on that page or through the Creative Cloud updater before closing the finding. Patch status is therefore 'Patch available per vendor advisory', with fixed versions to be taken from Adobe's published guidance rather than assumed. Where immediate updating is not possible, the practical mitigating controls are to avoid opening Bridge files from untrusted or unsolicited sources, strip or block risky file associations so Bridge does not auto-launch on documents received by email or download (side effect: legitimate workflows relying on those associations break), run Bridge under a low-privilege, non-administrative account or inside an application sandbox/VM to contain post-exploitation impact (side effect: reduced access to network shares and shared caches the user may need), and use application allow-listing or EDR rules to flag Bridge spawning unexpected child processes such as script interpreters or command shells (side effect: possible false positives during plugin or script-driven workflows). Because exploitation requires the victim to open a crafted file, user-awareness guidance against opening unexpected or untrusted assets is a meaningful secondary control for this specific vector.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122): a memory-safety defect in which a heap-allocated buffer is written past its bounds during Adobe Bridge's parsing of a file supplied by the user. Adobe Bridge is the Creative Cloud asset/thumbnail management application that ingests a wide range of image, camera-raw, and metadata-bearing documents, so the vulnerable code path sits in the local file-handling/parsing layer rather than in any remote service. Successful exploitation can corrupt heap metadata or adjacent objects and, in the classic heap-overflow pattern, be leveraged to hijack control flow and execute code with the privileges of the Bridge process - hence the high confidentiality, integrity, and availability impact ratings. The CPE records (cpe:2.3:a:adobe:bridge:*:*:*:*:*:*:*:*, with OS fields wildcarded) confirm the affected product is Adobe Bridge across platforms and do not pin a specific version; the authoritative version range comes from the Adobe advisory, which covers 14.1.8, 15.1.1 and earlier. The CVSS vector AV:L/PR:N/UI:R/S:U reflects that the attack is not remote, no prior authentication is needed, but a victim must open the crafted file, and the resulting code execution stays within the current user's security scope - an attacker needs a separate privilege-escalation step to reach system-level control.
Know when Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L and UI:R because the victim must locally open a malicious file; PR:N as no authentication is needed; full C/I/A:H since arbitrary code runs as the current user.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Bridge - the asset-management application relied on by creative, design, and marketing teams - contains a memory-corruption flaw that allows a malicious file to execute code on a user's workstation with that user's own privileges, including access to their locally stored design assets and any connected cloud services. There is no network-facing attack path: someone has to be persuaded to open a crafted file, so the realistic risk is a targeted social-engineering attempt against a creative employee rather than broad opportunistic scanning. No vendor patch has been identified at this time, which makes this an unmitigated but well-bounded workstation risk that leadership should track rather than escalate as a network emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: block untrusted file attachments at email and web gateways, enforce least privilege by removing local admin rights on creative workstations, disable or restrict Adobe Bridge for users who do not require it, deploy endpoint detection and behavioral monitoring for Adobe Bridge spawning unexpected child processes, and reinforce user awareness on opening files from unsolicited or untrusted sources. Apply vendor patch once an exact fixed version is confirmed via Adobe advisory APSB25-96.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attac
Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to ex
Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code
Joomla!. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low att
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers
Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could re
Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that
Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could r
Bridge versions 14.1.5, 15.0.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result
Arbitrary code execution in Bridge 15.1.3, 16.0.1 and earlier through an out-of-bounds write vulnerability triggered whe
Heap buffer overflow in Bridge versions 15.1.2 and 16.0 and earlier enables arbitrary code execution when users open spe
Arbitrary code execution in Bridge versions 15.1.3, 16.0.1 and earlier results from an integer overflow vulnerability th
GitHub PoC
Exploit-DB