Adobe Bridge CVE-2026-100129

Exploitation requires the victim to open an attacker-crafted malicious file within Adobe Bridge (the UI:R requirement) - it cannot be triggered remotely or without local user action. The vector is local (AV:L), so the attacker must first deliver the malicious file to the target. No authentication is required of the attacker (PR:N), and attack complexity is low (AC:L), meaning once the file is opened no additional special conditions, race windows, or non-default configurations are needed. The primary limiting factors are the mandatory user interaction and the local delivery requirement; affected deployments are Adobe Bridge versions ≤15.1.8 and ≤16.0.7.

This is a credible but second-tier priority. The CVSS 3.1 base score of 7.8 is driven by HIGH impact to confidentiality, integrity, and availability (C:H/I:H/A:H) enabling arbitrary code execution, but the attack vector is LOCAL (AV:L) and requires user interaction (UI:R) - a victim must open a malicious file. This is NOT a remotely-triggerable, wormable flaw; it is a client-side file-parsing bug typical of desktop creative applications. Exploitation status: no public exploit identified at time of analysis - the CVE is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation. No EPSS score, KEV entry, or SSVC decision data was provided in the input, so probabilistic exploitation likelihood cannot be quantified; this absence should not be read as either high or low risk. The signals are internally consistent (local vector + user interaction matches a 'open a malicious file' description), so there is no contradiction to flag. Net assessment: patch on a normal cycle, prioritizing workstations where Bridge users routinely open files from untrusted sources (e.g., downloaded assets, email attachments), but this does not warrant emergency out-of-band remediation absent exploitation evidence.

An attacker crafts a malicious image or asset file and delivers it to a victim via email, a shared drive, or a compromised download (e.g., a stock-asset site). When the victim opens or previews the file in Adobe Bridge, the malformed data triggers an out-of-bounds write that corrupts memory and executes attacker-controlled code with the victim's privileges. No public exploit code has been identified, and successful exploitation depends entirely on convincing the user to open the file.