Adobe Dimension CVE-2026-103846

Exploitation requires local delivery of malicious content and active user interaction: per the description, a victim must open and run the Adobe Dimension application on a crafted project/asset file for the improperly neutralized input to be processed during page/content generation. There is no network-reachable attack surface (AV:L), so an attacker must first get the malicious file onto the victim's system and convince them to open it. Limiting factors: requires user interaction (UI:R), is confined to local execution, and affects only Adobe Dimension versions up to and including 4.1.8; it does not apply to default remote/server exposure. The changed scope (S:C) indicates the resulting code execution can affect resources beyond Dimension's own security boundary.

The input CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.6) describes a local, low-complexity, unauthenticated-but-user-interaction-required flaw with full confidentiality, integrity, and availability impact and a changed scope - consistent with Adobe's PSIRT advisory (APSB26-171) and the CWE-79 (XSS) / RCE tagging. Although PR:N technically means no privileges are required, the AV:L and UI:R metrics make this a client-side, file/content-driven issue rather than a remotely reachable service vulnerability: an attacker cannot trigger it over a network without first delivering malicious content that the victim opens in Dimension. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is currently no public exploit identified and no evidence of active exploitation - the 8.6 'High' rating is driven by impact severity and scope change, not by demonstrated real-world exploitation. Net assessment: a genuinely high-impact bug worth patching on standard cycles, but its real-world risk is tempered by the local attack vector, the hard requirement for user interaction, and the limited deployment footprint of a niche design product; absent EPSS/KEV/POC signals this is a 'high-CVSS, moderate real-world urgency' issue rather than an emergency.

An attacker crafts a malicious Dimension project or asset file containing a payload that is improperly neutralized during web-page/content generation, then delivers it to a victim via email, download, or a shared-asset repository. When the victim opens and runs the file in Adobe Dimension, the injected content executes arbitrary code in the context of the current user. No public proof-of-concept exploit was identified in the provided data.