EUVD-2026-84776
GHSA-qp48-5vc6-wh48
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious file for Bridge parser
-
DeliveryDeliver via email or shared storage
-
ExploitVictim opens file in Adobe Bridge
-
ExecutionTrigger heap buffer overflow
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted malicious file in Adobe Bridge (UI:R) on the local machine (AV:L); code executes only in the context of the current user (S:U, no privilege escalation). Limiting factors: there is no remote/network trigger and no unauthenticated auto-exploitation - the attack depends on social engineering to deliver and induce opening of the file, and impact is bounded by the permissions of the user running Bridge. No special non-default configuration is required beyond having Adobe Bridge installed and used to open the file. |
| Impact | This is a genuine but conditional risk. The CVSS 3.1 vector (7.8 HIGH) is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning full confidentiality/integrity/availability impact (arbitrary code execution) but NOT remotely triggerable on its own: the AV:L + UI:R combination requires a victim to locally open a malicious file. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization. This places it in the 'high technical impact, human-gated delivery' category - dangerous if a targeted user is socially engineered, but not a mass-exploitable network flaw. Priority should be driven by patch management for Creative Cloud fleets rather than emergency response. No conflicting signals: the AV:L vector is consistent with a file-parsing memory-corruption bug, and the vendor score matches the described impact. |
| Exploit ScenarioDerived | An attacker crafts a malicious file (e.g., a document or asset Adobe Bridge parses) engineered to trigger a heap-based buffer overflow, then delivers it via email, a shared drive, or a download and lures a victim into opening it in Bridge. When Bridge parses the malformed file, the overflow corrupts heap memory and executes attacker-controlled code in the context of the current user. No public exploit code was identified at time of analysis, and successful exploitation depends entirely on the victim opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution with the privileges of the user running Bridge (CVE-2026-75649, CVSS 7.8). The attack is local-host only and depends on user interaction - a victim must open an attacker-supplied malicious file - so it cannot be triggered remotely or automatically, and code executes in the current user's context with no privilege escalation (AV:L/PR:N/UI:R/S:U). At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, but because the advisory is vendor-published and the flaw is a memory-corruption RCE class, it should be treated as a genuine but conditional risk requiring social engineering to deliver.
RemediationAI
Primary fix: update Adobe Bridge to the patched version listed in Adobe Security Bulletin APSB26-148 (https://helpx.adobe.com/security/products/bridge/apsb26-148.html) - the bulletin is the authoritative source for the exact fixed build numbers, which are not enumerated in the provided feed data (patch status: patch available per vendor advisory, exact version not specified in the input data). Updates are normally delivered through the Creative Cloud desktop application; also verify the version in-app via Help > About Adobe Bridge after updating, and push the update through your software-deployment tooling if Bridge is managed at scale. Until every endpoint is patched, compensating controls with their trade-offs are: instruct users not to open untrusted or unsolicited files in Bridge (this is the only known trigger, so training and mail/web download filtering directly remove the attack precondition, at the cost of relying on user behavior); remove or restrict Bridge's file-type associations and disable automatic preview/thumbnail generation for untrusted locations (reduces the chance a malicious file is parsed without an explicit open, but degrades the browsing workflow); run Bridge as a non-administrative user and, on Windows, enable Exploit Protection mitigations such as Export Address Filtering, Data Execution Prevention, and ASLR for the Bridge executable (these can break legitimate plug-ins and rendering features if validation fails); and detonate or inspect suspicious files in an isolated VM or sandbox before opening them on production systems. None of these controls eliminate the flaw - they only lower the probability of a successful trigger - so patching remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-122, a heap-based buffer overflow, which means the application allocates a buffer on the heap for parsed file content and then writes beyond the allocated bounds when handling a malformed structure. Adobe Bridge is a digital asset management and file-browsing application that automatically parses, decodes, and generates previews/thumbnails for a wide range of file formats (image, RAW, vector, metadata, and document formats) as users browse or open files; the overflow almost certainly lives in one of those format-handling or metadata-parsing code paths. Because the vulnerable object is heap-allocated, corruption of adjacent heap metadata or of neighboring objects can be leveraged to hijack control flow (for example, overwriting a function pointer or virtual table pointer) and execute attacker-controlled code. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the overflow is reached locally without pre-existing privileges, requires the victim to open the file interface (UI:R), stays within the current user's security scope (S:U, no elevation), and yields high confidentiality, integrity, and availability impact. The CPE entries cpe:2.3:a:adobe:adobe_bridge:*:*:*:*:*:*:*:* (listed twice, consistent with the separate Windows and macOS product builds) use wildcard versioning, so the intelligence feed does not enumerate a specific affected version range - the authoritative affected-version matrix is in Adobe Security Bulletin APSB26-148.
Know when Adobe Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parse trigger (AV:L) requiring victim to open a malicious file (UI:R); no prior auth needed (PR:N); heap overflow yields full code execution in the current user's context (C:H/I:H/A:H, S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Bridge is affected by a high-severity heap-based buffer overflow (CVE-2026-75649) that could allow an attacker to execute arbitrary code with the privileges of the user who opens a malicious file. Because exploitation requires local access and user interaction-such as opening a crafted file-and does not grant elevated privileges, the immediate organizational risk is moderate, but creative teams and other Bridge users remain exposed to targeted social engineering. No public exploit identified at time of analysis, and leadership should prioritize interim mitigations while monitoring for a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict opening of untrusted files, enforce application allowlisting, apply least-privilege user accounts, deploy EDR monitoring for process creation from Bridge, and conduct user awareness training on social engineering risks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user wh
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controll
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of t
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Exploit-DB