EUVD-2026-44499
GHSA-p2mm-qw8g-q2p9
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open bug (AV:L, UI:R) needing no prior auth (PR:N); reliable memory corruption (AC:L) yields code execution as the user with full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Technical ContextAI
Adobe Bridge is a digital-asset management application that ingests and renders a wide range of media and metadata file formats, exposing numerous parsers that process untrusted file content. The root cause is a CWE-787 out-of-bounds write, in which the application writes past the bounds of an allocated buffer - typically due to insufficient bounds validation while parsing a malformed asset - corrupting adjacent heap or stack memory. The vendor tags (RCE, Buffer Overflow, Memory Corruption) confirm this is a classic memory-corruption primitive that an attacker shapes into control-flow hijack. The CPE data (cpe:2.3:a:adobe:adobe_bridge) identifies the affected application as Adobe Bridge across unspecified version ranges, meaning the exact fixed build must be read from the APSB26-81 advisory.
RemediationAI
Update Adobe Bridge to the fixed version published in Adobe Security Bulletin APSB26-81 (https://helpx.adobe.com/security/products/bridge/apsb26-81.html) - the exact patched build is enumerated there and should be applied as the primary remediation, ideally via Adobe Creative Cloud desktop auto-update or managed deployment. Because exploitation requires a victim to open a malicious file, effective interim compensating controls until patching is complete are: restrict opening of Bridge asset files from untrusted or external sources (email, downloads, shared drives) with the trade-off of impeding legitimate collaboration workflows; enforce endpoint protection and application allow-listing on creative workstations; and educate asset-handling users not to open unsolicited files. No vendor-released patch version is quoted in the supplied data beyond the advisory reference, so confirm the exact fix build from APSB26-81 before deployment - do not assume a version number.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affecte
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a malic
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-o
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerabilit
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by ent
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the c
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today