Adobe Bridge CVE-2026-100128

Exploitation requires the victim to open an attacker-supplied malicious file directly in Adobe Bridge; the vulnerable code path is in Bridge's file/asset parsing. Limiting factors: the vector is LOCAL (AV:L) with required user interaction (UI:R), so the attacker cannot trigger this remotely or without a user action - they must first socially engineer the victim into opening the crafted file. No elevated privileges are needed to run the exploit (PR:N), but code executes only in the context of the current user, not with elevated system rights. Affected: Adobe Bridge versions ≤15.1.8 and ≤16.0.7; updating past these versions removes exposure.

This is a legitimately actionable local code-execution flaw but not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes the classic Adobe desktop-application pattern: the attack vector is LOCAL because code only triggers once a victim opens a malicious file, and it requires user interaction (UI:R), which meaningfully caps automatability and scale. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input. There is no public exploit identified at time of analysis, and the issue is NOT in CISA KEV, so there is no confirmation of active exploitation - real-world urgency rests on social-engineering likelihood (a user opening a crafted file) rather than remote mass exploitation. The high confidentiality/integrity/availability impacts are credible for an out-of-bounds write (CWE-787) leading to arbitrary code execution in the current user's context. Net: a genuine high-severity patch-soon item for environments running Adobe Bridge, but materially lower real-world risk than a network-reachable unauthenticated RCE, and the absence of EPSS/KEV/POC signals means prioritization should weigh user exposure to untrusted files rather than assume broad opportunistic attacks.

An attacker crafts a malicious image or asset file and delivers it to a victim via email, a shared drive, or a download. When the victim opens the file in Adobe Bridge, an out-of-bounds write corrupts memory and executes arbitrary code in the context of that user. No public proof-of-concept was provided, and the local vector plus required user interaction mean the attack depends on successful social engineering rather than remote triggering.