EUVD-2026-35834
GHSA-53q2-mqcg-jhm2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Format Plugins 1.1.2 and earlier occurs through a heap-based buffer overflow that executes in the current user's security context when a victim opens a maliciously crafted file. The flaw was reported by Adobe PSIRT and carries a CVSS 7.8 (high) score, but no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, suggesting it is currently a patching priority rather than an active incident.
Technical ContextAI
The affected component is Adobe's Format Plugins, a set of file-format parsing modules used by Adobe creative applications to read and interpret various media/document formats. The root cause is CWE-122 (Heap-based Buffer Overflow), in which the plugin's parser writes data past the bounds of a heap-allocated buffer - typically because a size, length, or count field embedded in the malicious file is not validated against the size of the destination allocation. Heap overflows of this kind commonly allow corruption of adjacent heap metadata or function pointers, which an attacker shapes through heap-grooming to redirect execution. CPE strings for the specific affected SKU were not enumerated in NVD at time of analysis; the Adobe advisory APSB26-65 is the authoritative source for product coverage.
RemediationAI
Apply the fixed Format Plugins release referenced in Adobe Security Bulletin APSB26-65 (https://helpx.adobe.com/security/products/formatplugins/apsb26-65.html) - the exact fixed version number is not enumerated in the input data, so administrators should pull the version listed in that bulletin rather than rely on an inferred build. Until patching is complete, reduce exposure by instructing users not to open Format Plugin-supported files from untrusted sources, blocking the relevant file extensions at the mail gateway or web proxy for high-risk user populations (trade-off: this can interfere with legitimate creative workflows), and considering application-level controls such as Protected View / sandboxing where the host Adobe product supports them. Endpoint exploit-mitigation features (ASLR, CFG, heap hardening) should be verified as enabled, as they materially raise the bar for heap-overflow exploitation.
More in Format Plugins
View allOpening a malicious file in Adobe Format Plugins can trigger a heap-based buffer overflow, allowing arbitrary code execu
Arbitrary code execution in Adobe Format Plugins versions 1.1.2 and earlier occurs via a heap-based buffer overflow trig
Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory
Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory
Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory
Format Plugins versions 1.1.1 and earlier are affected by a Use After Free vulnerability that could lead to memory expos
Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory
Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory
Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted fil
Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result i
Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result i
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today