EUVD-2026-44497
GHSA-35r6-wcp2-v9mw
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user so AV:L and UI:R; no prior privileges needed (PR:N), and memory-corruption RCE yields full C/I/A impact within the user's context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.
Technical ContextAI
Adobe Bridge is Adobe's digital-asset management and media-browser application used alongside Creative Cloud tools (Photoshop, InDesign, Illustrator) to organize, preview, and batch-process images and documents. The root cause is CWE-787 (Out-of-bounds Write): while parsing the contents of a crafted file, Bridge writes past the bounds of an allocated buffer, corrupting adjacent memory. This class of memory-corruption bug is commonly exploitable for control-flow hijacking and, as reflected by the C:H/I:H/A:H impact, can be leveraged to execute arbitrary native code in the process. The CPE data (cpe:2.3:a:adobe:adobe_bridge) confirms the affected component is the Adobe Bridge desktop application; the wildcard version field indicates specific fixed builds must be read from the APSB26-81 advisory.
RemediationAI
Patch available per vendor advisory: update Adobe Bridge to the fixed release documented in Adobe Security Bulletin APSB26-81 (https://helpx.adobe.com/security/products/bridge/apsb26-81.html); apply the update through the Creative Cloud desktop app or Adobe's update channel and confirm the exact patched build number from that advisory, as the input data does not include an explicit fix version. Until the update is deployed, the practical compensating control is to avoid opening Bridge files (images, thumbnails, or asset files) received from untrusted or unsolicited sources and to handle unknown media only in isolated or sandboxed environments; because exploitation depends on user interaction, user-awareness guidance and application allow-listing that restricts Bridge from launching child processes reduce the realistic attack surface, at the cost of workflow friction for teams that routinely ingest external assets.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affecte
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a malic
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-o
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerabilit
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by ent
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the c
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today