EUVD-2026-49945
GHSA-x7r3-wfm5-6xm2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Adobe Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user wh
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controll
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of t
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Exploit-DB