Adobe Bridge CVE-2026-48391

Exploitation requires local delivery plus mandatory user interaction: the victim must open a malicious file in Adobe Bridge (version ≤16.0.5 on the 16.x branch or ≤15.1.6 on the 15.x branch), and the attacker must be positioned to place a malicious library in a directory that Bridge searches ahead of the trusted location (CWE-426 untrusted search path / library-load hijack). Limiting factors: no remote/network exploitation (AV:L), the attack fails without the social-engineering step of getting the victim to open the crafted file, and resulting code execution is confined to the current user's privilege level rather than SYSTEM/root. No active exploitation or public exploit code exists to lower the practical barrier.

The signals converge on moderate, not urgent, priority. The CVSS 3.1 base of 8.2 (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) is driven up by a scope change and full CIA impact, but every exploitation-likelihood signal is low: EPSS is 0.15% (5th percentile), CISA SSVC records Exploitation:none and Automatable:no (Technical Impact:total only reflects the code-exec payload, not likelihood), there is no CISA KEV listing, and no public proof-of-concept is referenced. This is therefore a high-severity-but-low-real-risk item - the CWE-426 untrusted search path class requires the attacker to first place a malicious library/file where the victim will trigger it and then socially engineer the victim into opening a crafted file, which is why the vector is AV:L/UI:R rather than a wormable network flaw. Two metric choices warrant scrutiny: Adobe's PR:L is questionable for a file-open exploit that needs no attacker-held privileges (PR:N is more defensible), and the S:C (scope changed) claim is atypical for untrusted-search-path code execution that runs squarely 'in the context of the current user' as the description states - verify scope with the vendor advisory. Net: patch on the normal cycle; not a drop-everything emergency absent any active-exploitation or POC signal.

An attacker plants a malicious DLL/library alongside a Bridge-associated asset file (e.g., in a shared folder, archive, or download) and lures a creative-team user into opening that file with Adobe Bridge; Bridge resolves a dependency via an untrusted search path and loads the attacker's library, executing arbitrary code with the victim's privileges. No public exploit code is identified at time of analysis, and SSVC records no known exploitation, so this remains a theoretical/targeted-social-engineering scenario rather than mass exploitation.