EUVD-2026-100569
GHSA-qhh9-jmxq-h85x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious Dimension file to victim
-
ExploitVictim opens file in Adobe Dimension
-
ExecutionTrigger out-of-bounds read in file parser
-
ImpactDisclose adjacent sensitive process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted malicious file in Adobe Dimension (version ≤4.1.8) - this mandatory user interaction (UI:R) is the primary limiting factor, as the flaw cannot be triggered remotely or automatically. The vector is local (AV:L): the attacker needs no prior authentication or privileges (PR:N) but must socially engineer the victim into opening the file locally. Impact is confined to disclosure of sensitive process memory (C:H, I:N, A:N); there is no code execution or data modification, and no special product configuration is needed beyond a standard Dimension installation parsing the malicious file. |
| Impact | This is a genuinely moderate-risk issue, not a top-tier priority, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) describes a local vector requiring the victim to open a malicious file; it has only confidentiality impact (no integrity or availability loss), matching the CWE-125 out-of-bounds read that discloses memory. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed activity), Automatable=no (each victim must be socially engineered into opening a file), and Technical Impact=partial (information disclosure only). There is no CISA KEV listing, no public exploit code referenced, and no EPSS score provided in the input. All available signals agree this is a lower-severity, interaction-dependent information-disclosure flaw rather than a wormable or remotely weaponizable vulnerability. No key signals conflict; the main gap is the absent EPSS probability, which cannot be substituted here. |
| Exploit ScenarioDerived | An attacker crafts a malicious Dimension-compatible file (e.g., a booby-trapped 3D/design document) and delivers it to a victim via email, download, or a shared asset. When the victim opens the file in a vulnerable Adobe Dimension build (≤4.1.8), the out-of-bounds read triggers and leaks adjacent process memory, which the attacker can use to disclose sensitive data. No public exploit code was identified at time of analysis, and exploitation hinges entirely on the victim opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Sensitive process-memory disclosure in Adobe Dimension 4.1.8 and earlier is triggered when a victim opens an attacker-crafted file, allowing an unauthenticated attacker to read out-of-bounds memory contents. The flaw is local (AV:L) and requires user interaction (UI:R) - the attacker must socially engineer the target into opening a malicious file on their own machine; there is no remote or automatic trigger. Impact is limited to confidentiality (C:H) with no code execution, data modification, or denial of service, EPSS/KEV status is negative, and no public exploit code has been identified at time of analysis, so this is a moderate-priority file-parsing issue rather than a top-tier emergency.
RemediationAI
Patch available per vendor advisory: update Adobe Dimension to the corrected release documented in Adobe's APSB26-171 advisory (https://www.adobe.com/trust/security/products/dimension/apsb26-171.html) - any build later than the affected 4.1.8 range resolves the out-of-bounds read; the exact fixed version number is not stated in the supplied intelligence, so confirm it against the advisory before validating remediation. Until systems are updated, the most effective compensating control is to eliminate the attack path: block or quarantine untrusted .dn and third-party 3D/design asset files at the email gateway and web proxy, and require users to open Dimension project files only from trusted, vetted sources - the trade-off is reduced workflow flexibility for legitimate external asset exchange and potential false positives on valid 3D content. Additional hardening includes running Dimension under a low-privilege, non-administrative account in a sandboxed or virtualized environment so that any leaked memory cannot expose higher-value secrets, and restricting access to sensitive files on the same host (the C:H impact means disclosure is only as damaging as what is in-memory), which carries some performance and usability overhead and does not block the bug itself. Application allowlisting and EDR monitoring for anomalous Dimension crash or high-memory-read behavior can provide detection coverage, but these are detective, not preventive, controls. Standard patching cadence and user awareness training against opening unsolicited design files should accompany the update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an out-of-bounds read (CWE-125) in Adobe Dimension, Adobe's 3D design and rendering application for product mockups, packaging, and brand visualization. Dimension parses a wide range of 3D and design asset formats, and the defect lies in that parsing/decoding logic: when processing a malformed file, the application reads past the end of an allocated buffer and the over-read bytes can be returned in the resulting output, leaking adjacent heap/process memory. The provided CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms a local attack path with no privileges required, mandatory user interaction, unchanged scope, and high confidentiality impact but no integrity or availability impact - i.e., a pure information-disclosure primitive, not a memory-corruption/execution primitive. Community tags classify the issue under 'Buffer Overflow' and 'Information Disclosure'; the CWE-125 mapping and the I:N/A:N vector indicate read-only out-of-bounds access rather than a writable overflow, which is consistent with the absence of code-execution impact in the authoritative assessment. EUVD tracks the same issue as EUVD-2026-100569 for Adobe Dimension versions 0 through 4.1.8.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open attack requires victim interaction (AV:L/UI:R) with no privileges (PR:N); out-of-bounds read yields memory disclosure only, so C:H, I:N, A:N.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB