EUVD-2026-65680
GHSA-483g-5qp2-mhww
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally requiring active user interaction (AV:L/UI:R); no attacker privileges needed; full RCE impact scoped to victim's user session (S:U/C:H/I:H/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Adobe XD's file parser contains a classic buffer overflow (CWE-120) that enables arbitrary code execution at the privilege level of the current user when a victim opens a maliciously crafted XD file. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact offset by a local attack vector and mandatory user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively open a specially crafted Adobe XD file on a system with a vulnerable version of Adobe XD installed - this is the sole precondition (UI:R in CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly captures a local file-open scenario: attack complexity is low once the victim opens the file, no privileges are required on the attacker's side, but user interaction is mandatory - a genuine friction point. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Adobe XD project file that embeds an oversized payload designed to overflow a parser buffer and redirect execution. The file is delivered to a designer via a phishing email, a compromised file-sharing link, or a poisoned design asset repository. … |
| Remediation | Patch available per vendor advisory - consult Adobe security bulletin APSB26-125 at https://helpx.adobe.com/security/products/xd/apsb26-125.html for the specific fixed version and update instructions; an exact patched version number was not included in the available intelligence and should be confirmed directly from that advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, issue a security alert to all XD users instructing them to avoid opening XD files from untrusted sources and to scrutinize email attachments or cloud-shared projects. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today