Adobe Bridge CVE-2026-48343

Exploitation requires the victim to open an attacker-crafted malicious file in Adobe Bridge - this user interaction (UI:R) is the mandatory precondition explicitly stated in the description. The attack vector is local (AV:L), so the attacker must deliver the file to the target and cannot exploit over the network or automatically; code runs only in the context of the current user (S:U, no privilege escalation). Limiting factors that reduce realistic risk: the requirement for social engineering to get the file opened, the need for Adobe Bridge to be installed and used to open the file, and the absence of any known public exploit or active exploitation. No special product configuration or non-default feature is required beyond having Bridge process the malicious file.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a 7.8 High severity driven by high impact across all three security properties, but the local attack vector (AV:L) and required user interaction (UI:R) are the key limiting factors: an attacker cannot exploit this remotely or automatically, and instead depends on a victim opening a malicious file. PR:N confirms no prior authentication is needed once the file is opened. No EPSS score, KEV listing, or POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this places it below same-CVSS bugs that are network-reachable or KEV-listed. It is a genuine priority for organizations with Bridge on creative-professional endpoints, but it is a social-engineering-gated client-side bug rather than a wormable or mass-exploitable flaw. Note the tension worth flagging: the description says 'arbitrary code execution' (RCE) yet the vector is AV:L, which is normal for file-open document bugs but should not be read as remote network exploitation.

An attacker crafts a malicious Bridge-supported asset or metadata file that triggers the out-of-bounds write and emails or shares it with a target creative professional under a plausible pretext (e.g., a project asset pack). When the victim opens the file in Adobe Bridge, the memory corruption is triggered and attacker-controlled code executes with the victim's privileges. No public exploit was identified at time of analysis, but the low attack complexity (AC:L) means a working exploit would reliably fire once the file is opened.