EUVD-2026-22689
GHSA-fmj2-h384-m84p
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution via heap-based buffer overflow in Adobe Bridge (versions 16.0.2, 15.1.4 and earlier) allows local attackers to execute code in the user's security context by tricking victims into opening specially crafted malicious files. No public exploit identified at time of analysis, with SSVC assessment indicating no current exploitation, non-automatable attack requiring user interaction, and total technical impact upon successful compromise.
Technical ContextAI
This vulnerability stems from a heap-based buffer overflow (CWE-122) in Adobe Bridge's file parsing routines. When Bridge processes malformed input files, insufficient bounds checking allows attacker-controlled data to overflow heap-allocated memory buffers. This memory corruption can overwrite critical data structures or function pointers on the heap, enabling control flow hijacking and arbitrary code execution. Heap overflows are particularly dangerous in media processing applications like Bridge, which handle complex file formats (images, videos, metadata) that provide numerous attack surfaces for malformed input. The vulnerability affects Bridge versions 16.0.2, 15.1.4, and all earlier releases in both version branches, indicating a long-standing code flaw in the application's file handling infrastructure.
RemediationAI
Adobe has released security updates addressing this vulnerability in APSB26-39. Organizations should immediately upgrade to the patched versions released by Adobe, available through the Creative Cloud desktop application or direct download from Adobe's security advisory at https://helpx.adobe.com/security/products/bridge/apsb26-39.html. Until patching is complete, implement defense-in-depth controls including restricting Bridge users from opening files from untrusted sources, deploying endpoint detection and response (EDR) solutions to monitor for heap corruption exploitation attempts, and enforcing application allowlisting to prevent unauthorized code execution. Security awareness training should emphasize the risks of opening unsolicited media files, particularly those received via email or downloaded from unverified websites.
Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attac
Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to ex
Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers
Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could re
Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that
Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could r
Bridge versions 14.1.5, 15.0.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result
Arbitrary code execution in Bridge 15.1.3, 16.0.1 and earlier through an out-of-bounds write vulnerability triggered whe
Heap buffer overflow in Bridge versions 15.1.2 and 16.0 and earlier enables arbitrary code execution when users open spe
Arbitrary code execution in Bridge versions 15.1.3, 16.0.1 and earlier results from an integer overflow vulnerability th
Heap-based buffer overflow in Adobe Bridge 16.0.2, 15.1.4, and earlier versions enables arbitrary code execution with vi
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today