Adobe Dimension CVE-2026-103844

Exploitation requires a victim running Adobe Dimension version ≤4.1.8 to open a maliciously crafted file (a Dimension project or imported 3D asset) - the attack cannot occur without this user action (UI:R) and cannot be launched remotely across the network (AV:L). No authentication or elevated privileges are needed on the attacker side to craft the file (PR:N), and no special product configuration is required beyond having the vulnerable application installed and used to open untrusted files. The primary limiting factors are the mandatory user interaction, the local delivery requirement, and the restricted installed base of this discontinued product; code executes only at the privilege level of the user who opened the file (S:U).

This is a genuine but operationally-constrained local-exploitation risk, not a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic client-side memory-corruption flaw: an attacker cannot reach the vulnerable code over the network but must get a victim to open a malicious file, after which code executes with full CIA impact in the current user's context. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - UI:R aligns with the description's 'victim must open a malicious file,' and AV:L correctly reflects file-based rather than remote delivery - so there is no CVSS-vs-description conflict to flag. The practical priority is moderate: patch promptly for workstations where Dimension is used and users handle untrusted .dn/3D asset files, but this does not carry the urgency of a remotely-reachable unauthenticated bug. The absence of EPSS/KEV here reflects missing signals rather than confirmed low risk; real-world risk is primarily gated by how many users actually run this now-deprecated product.

An attacker crafts a malicious Dimension project or 3D asset file and delivers it via email, a shared drive, or a download disguised as legitimate design content. When the victim opens the file in a vulnerable Adobe Dimension build (≤4.1.8), the out-of-bounds write triggers memory corruption that executes arbitrary code with the victim's privileges. No public proof-of-concept was identified in the provided data, and success depends on the user actively opening the attacker-supplied file.