Adobe Bridge CVE-2026-100126

Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Bridge (UI:R) on a system running a vulnerable version (Adobe Bridge ≤15.1.8 or ≤16.0.7); it is a local vector (AV:L), not a network-triggered or server-side flaw. The key limiting factor is this mandatory user interaction - the attacker cannot trigger the parser remotely and must socially engineer the victim into opening the crafted file. No authentication or elevated privileges are needed by the attacker (PR:N), and the impact is limited to information disclosure, so there is no code execution or integrity/availability effect from this issue alone.

This is a moderate-severity information disclosure flaw (CVSS 5.5) in Adobe Bridge, reported through Adobe PSIRT (APSB26-167). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N is internally consistent with the description: AV:L plus UI:R reflects that exploitation is not remote-over-network but requires a victim to locally open a malicious file, and the impact is confined to confidentiality (C:H / I:N / A:N), matching the out-of-bounds read (CWE-125) that discloses memory. No EPSS score, KEV listing, or POC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of a required-user-interaction, local-only vector with no exploit signals places this well below drop-everything priority: it is a high-CVSS-for-its-class memory disclosure but a low-real-world-urgency issue absent any exploitation evidence. Note one caveat: the input Tags include 'Buffer Overflow', which conflicts with the description and CWE-125 (an out-of-bounds READ, not a write/overflow) - treat the tag as imprecise and rely on the CWE. Patch priority should follow normal Adobe Patch Tuesday cadence rather than emergency response.

An attacker crafts a malformed document (e.g., an image or metadata file that Bridge parses) and delivers it to a victim via email, download, or a shared asset library. When the victim opens the file in Adobe Bridge, the parser reads past an allocated buffer boundary, and the leaked adjacent memory - potentially containing sensitive data such as pointers or document fragments - is disclosed to the attacker. No public proof-of-concept is identified in the provided data, and exploitation cannot occur without the victim opening the malicious file.