EUVD-2026-84774
GHSA-rhw7-37ww-33xv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious asset file
-
DeliveryDeliver via email or shared library
-
ExploitVictim opens file in Bridge
-
ExecutionTrigger uncontrolled recursion in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires a local victim to manually open an attacker-supplied malicious file in Adobe Bridge (AV:L, UI:R); code then runs in that user's context (S:U, no privilege escalation implied). No authentication is required of the attacker (PR:N), but there is no remote or network-facing vector - delivery depends entirely on social engineering the victim into opening the crafted file. Limiting factors: mandatory user interaction, local-only vector, execution confined to the current user's privileges, and applicability only to unpatched Adobe Bridge versions listed in APSB26-148. |
| Impact | This is a client-side, file-format-triggered code-execution flaw in Adobe Bridge scored 7.8 (HIGH) by the vendor. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H is internally consistent for a malicious-file-open bug: AV:L plus UI:R means the attacker cannot reach the victim over the network directly - a user must be socially engineered into opening a crafted file locally. There is no CISA KEV listing, no public POC, and no EPSS score supplied, so the exploitation status is: no public exploit identified at time of analysis. The 7.8 base score is driven almost entirely by the C:H/I:H/A:H impact triad (full compromise of the current user's context), NOT by ease of reach - the UI:R and AV:L gates substantially lower real-world risk versus a network-reachable unauthenticated RCE. Note the CWE is CWE-674 (Uncontrolled Recursion), which typically yields stack exhaustion/crash (a DoS/availability primitive); Adobe asserts this recursion escalates to arbitrary code execution, but that ACE claim rests solely on the vendor advisory and is not independently corroborated. Realistic priority: moderate - patch in normal cycles, prioritize for workstations where analysts/designers routinely open untrusted asset files, but this is not a mass-exploitation, drive-by, or wormable condition. |
| Exploit ScenarioDerived | An attacker crafts a malicious media/asset file that triggers uncontrolled recursion in Adobe Bridge's file parser and delivers it via email, a shared asset library, or a download, luring a designer into opening it. When the victim opens the file in Bridge, the recursion is abused to execute arbitrary code in the victim's user context. No public exploit code is known, and successful exploitation requires the local victim to actively open the attacker's file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controlled code to run with the privileges of the current user. The issue is scored 7.8 (HIGH) and is a client-side, file-format-triggered flaw with a local attack vector and mandatory user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); the attacker does not authenticate to the product, but delivery depends entirely on social engineering the victim into opening the malicious file. Only unpatched Adobe Bridge versions addressed by vendor advisory APSB26-148 are affected, and no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory: apply the Adobe Bridge update referenced in Adobe security advisory APSB26-148 (https://helpx.adobe.com/security/products/bridge/apsb26-148.html), which lists the exact fixed versions for Windows and macOS; because the advisory is the only authoritative source of the fix line and no discrete version number was supplied in the intelligence feed, confirm the resolved build directly in that bulletin before closing the finding, and prioritize Creative Cloud and manually installed endpoints that do not auto-update. Because exploitation requires a local victim to open a malicious file, the highest-value compensating controls are attachment and download filtering that blocks or quarantines untrusted image, document, and Bridge-related file types at mail and web gateways (trade-off: false positives on legitimate creative asset exchange, so tune per business unit), plus user awareness guidance not to open files from unknown senders. On managed fleets, remove or restrict file-type associations and preview/thumbnail handlers for untrusted formats so files cannot be auto-parsed by Bridge (trade-off: degrades the asset-preview workflow), and run Bridge under a standard, non-administrative account where feasible so any code execution stays within limited user rights. Endpoint detection and response rules targeting unexpected child processes spawned by Bridge can provide detection coverage while patching completes, but none of these controls eliminates the flaw - only installing the patched build does.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-674, Uncontrolled Recursion, in the file-parsing code path of Adobe Bridge on Windows and macOS, as identified by the CPE entries cpe:2.3:a:adobe:adobe_bridge. Bridge ingests a wide range of image, document, and metadata-bearing formats, and the vulnerable routine follows nested or self-referential structures in a crafted file without an effective recursion-depth or complexity bound. That unbounded recursion exhausts the process call stack, producing memory corruption that Adobe classifies as exploitable for arbitrary code execution rather than a simple denial of service. Because the flaw is triggered inside a locally launched application and the resulting code inherits the invoking user's token (S:U), exploitation does not cross a privilege boundary and grants no elevation beyond the account that opened the file. The affected surface is therefore the parser itself, not a network service, which is why the vector is AV:L with UI:R despite PR:N.
Know when Adobe Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file-open flaw needing victim interaction (AV:L/UI:R/PR:N), no scope change, full compromise of the current user (C:H/I:H/A:H), consistent with vendor.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Bridge is affected by a high-severity arbitrary code execution vulnerability that requires a user to open a malicious file, potentially allowing attackers to run code with the victim's privileges. This puts creative and design teams who routinely open untrusted assets at risk, and with no vendor patch currently available, leadership should prioritize interim mitigations to prevent potential data breaches or system compromise. No public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis; implement interim mitigations such as restricting file opening to trusted sources, blocking risky file types via email/web gateways, applying application whitelisting, enforcing least privilege, and conducting user awareness training to reduce social engineering success.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user wh
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of t
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Exploit-DB