What is the CVSS score of CVE-2026-34630?

CVE-2026-34630 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Bridge are affected by CVE-2026-34630?

Adobe Bridge versions 16.0.2, 15.1.4, and earlier contain a heap-based buffer overflow vulnerability that could allow attackers with local access to execute arbitrary code by tricking users into…

How to fix or mitigate CVE-2026-34630?

Within 24 hours: identify all systems running Adobe Bridge 16.0.2, 15.1.4, or earlier via asset inventory or EDR tools; issue user advisory prohibiting opening Bridge files from untrusted sources. Within 7 days: configure file execution policies to restrict Bridge opening of files from Downloads and email folders; consider disabling Bridge if not business-critical. Within 30 days: upgrade to Adobe Bridge 16.1 or later once available, or coordinate with Adobe for patch release timeline; validate patch deployment across 100% of affected endpoints.

Bridge CVE-2026-34630

EUVD-2026-22699 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-14 psirt@adobe.com

Heap Overflow Buffer Overflow RCE Bridge

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 22:38 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 20:22 euvd

EUVD-2026-22699

Analysis Generated

Apr 14, 2026 - 20:22 vuln.today

CVE Published

Apr 14, 2026 - 20:16 nvd

HIGH 7.8

DescriptionCVE.org

Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Heap-based buffer overflow in Adobe Bridge 16.0.2, 15.1.4, and earlier versions enables arbitrary code execution with victim's privileges when processing maliciously crafted files. Attack requires local access and user interaction (opening a weaponized file). CVSS 7.8 (High) reflects significant impact but local-only attack vector. No public exploit identified at time of analysis, and exploitation probability remains moderate given the user interaction requirement and local access constraint.

Technical ContextAI

Adobe Bridge is a digital asset management application used for organizing and browsing creative files. This vulnerability stems from CWE-122 (Heap-based Buffer Overflow), a memory corruption flaw where the application fails to properly validate input size before copying data into heap-allocated memory buffers during file parsing operations. When Bridge processes specially crafted files, attacker-controlled data overflows heap boundaries, corrupting adjacent memory structures. This corruption can be leveraged to redirect program execution flow, ultimately allowing arbitrary code execution. The heap-based nature indicates dynamic memory allocation is involved, typically during parsing of complex file formats that Bridge supports (PSD, AI, INDD, or image formats). The vulnerability affects Bridge versions through 15.1.4 and 16.0.2, indicating two separate release branches are impacted.

RemediationAI

Adobe has released security updates to address this vulnerability. Users should immediately upgrade to Bridge version 16.0.3 or later for the 16.x branch, or version 15.1.5 or later for the 15.x branch (specific fixed versions to be confirmed in vendor advisory APSB26-39). Organizations should prioritize patching systems where users regularly process files from untrusted or external sources. As an interim mitigation, implement strict controls on opening Bridge files from unknown sources, educate users about risks of opening unsolicited project files or templates, and consider application whitelisting or sandboxing to limit code execution impact. Complete remediation guidance and download links are available in Adobe Security Bulletin APSB26-39 at https://helpx.adobe.com/security/products/bridge/apsb26-39.html.