EUVD-2026-35802
GHSA-rrmh-w6hx-2f5g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Dreamweaver file
-
DeliveryDeliver via phishing or template site
-
ExploitVictim opens file in Dreamweaver
-
ExecutionUninitialized pointer dereferenced during parsing
-
PersistArbitrary code execution as current user
-
ImpactEstablish persistence or exfiltrate source/credentials
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Uninitialized pointer prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied file in Adobe Dreamweaver Desktop version 21.7 or earlier; the CVSS vector AV:L/UI:R confirms local file delivery and explicit user interaction are mandatory, and PR:N means no prior authentication or privileges on the target are needed. Exploitation is bounded by the need to (1) have Dreamweaver Desktop installed and chosen to open the file, (2) reach a vulnerable parsing path that touches the uninitialized pointer, and (3) operate within the privileges of the current user - code execution does not automatically yield SYSTEM/root. There is no network-exposed attack surface and no remote/headless trigger described, so air-gapped or kiosk hosts that never open external files are effectively out of scope. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High) and accurately reflects a client-side memory corruption bug: exploitation requires local file delivery and user interaction (opening a malicious file), but no privileges, and impact is full confidentiality, integrity, and availability loss in the user's context. The vulnerability is not listed in CISA KEV and no public PoC is referenced in the available intelligence, so this is not currently in the 'patch within hours' tier; EPSS data was not provided. Real-world priority is moderate: high for workstations of web developers who routinely open project files from external sources (clients, freelancers, downloaded templates), and lower for locked-down environments where Dreamweaver is not used or files are not exchanged externally. No conflicting signals were observed between the description and CVSS vector. |
| Exploit ScenarioDerived | An attacker crafts a malicious Dreamweaver-associated file (for example a project, template, or markup asset) and delivers it to a target web developer via phishing email, a fake client brief, or a compromised template marketplace. When the victim opens the file in Dreamweaver Desktop 21.7 or earlier, the uninitialized pointer is dereferenced during parsing and the attacker gains arbitrary code execution as the logged-in user, enabling credential theft, source code exfiltration, or a foothold for lateral movement. No public exploit identified at time of analysis, but the bug class (CWE-824) is well understood and within reach of skilled exploit developers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Arbitrary code execution in Adobe Dreamweaver Desktop versions 21.7 and earlier allows attackers to run code in the context of the current user when a victim opens a malicious file. The flaw stems from access of an uninitialized pointer (CWE-824) and is tracked under Adobe advisory APSB26-62. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Apply the fixed Dreamweaver Desktop release published by Adobe in security bulletin APSB26-62 (https://helpx.adobe.com/security/products/dreamweaver/apsb26-62.html); the bulletin lists the exact patched build number and channel, and the advisory should be used as the source of truth since a specific fix version is not enumerated in this intelligence beyond 'after 21.7.' Until update deployment, instruct users not to open Dreamweaver project files, templates, or assets received from untrusted sources (email attachments, downloads, shared drives) and prefer opening such files in a sandboxed VM, accepting the productivity trade-off of slower review workflows. Application-level controls such as removing Dreamweaver from systems that do not need it and enforcing OS-level exploit mitigations (Windows Exploit Protection / macOS Gatekeeper and Hardened Runtime) reduce residual risk but do not substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Dreamweaver Desktop is a commercial WYSIWYG web authoring application that parses a variety of project, markup, and asset file formats on the client side. The root cause is CWE-824 (Access of Uninitialized Pointer), a memory-safety defect in which the application dereferences a pointer that was never assigned a valid value, typically because an initialization path was skipped during file parsing. When the uninitialized pointer happens to hold attacker-influenced data, dereferencing it can be turned into a controlled write or jump primitive, leading to arbitrary code execution in the process. The affected CPE is cpe:2.3:a:adobe:dreamweaver_desktop:*:*:*:*:*:*:*:* covering Dreamweaver Desktop builds up to and including 21.7.
Know when Dreamweaver Desktop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
DescriptionCVE.org
Dreamweaver Desktop versions 21.7 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Dreamweaver Desktop
View allArbitrary file system read in Adobe Dreamweaver Desktop versions 21.7 and earlier allows attackers to access sensitive f
Arbitrary code execution in Adobe Dreamweaver Desktop 21.7 and earlier stems from a vulnerable third-party component bun
Arbitrary file system read in Adobe Dreamweaver Desktop 21.7 and earlier allows a local attacker to access sensitive fil
Incorrect Authorization in Adobe Dreamweaver Desktop 21.7 and earlier enables arbitrary file system reads beyond the app
Exploit-DB