EUVD-2026-84777
GHSA-4prx-hcjc-ggfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious asset file
-
DeliveryDeliver to victim via email/download
-
ExploitVictim opens file in Adobe Bridge
-
ExecutionOut-of-bounds read in parser
-
ImpactDisclose adjacent process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted malicious file in Adobe Bridge on their local machine (UI:R, AV:L); it cannot be triggered remotely or without user interaction. No authentication or elevated privileges are needed (PR:N), but the attacker must first deliver the file and socially engineer the target into opening it in Bridge. There is no server-side or default-network exposure - the desktop application must actively parse the hostile asset. Impact is limited to disclosure of sensitive process memory (C:H); the flaw alone does not modify data or crash the application. |
| Impact | This is a genuine but modest-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a client-side, local attack: an out-of-bounds read (CWE-125) reachable only when a victim opens a malicious file in Adobe Bridge. Although PR:N (no privileges), the AV:L plus UI:R combination means exploitation depends entirely on social engineering the victim into opening attacker-supplied content - there is no remote or automated vector. Impact is confidentiality-only (C:H, I:N, A:N): the flaw discloses sensitive process memory (potential for ASLR/canary leaks or data theft) but does not by itself yield code execution or integrity/availability loss. No EPSS score, CISA KEV listing, or public exploit code is present in the supplied intelligence, and Adobe's APSB26-148 advisory is self-reported with no indication of in-the-wild use. No SSVC decision data was provided. Signals are internally consistent (memory-safety read bug, local file-parse vector) with no CVSS-vs-description conflict; the main missing data is affected/fixed version ranges - the CPE strings are wildcarded (adobe_bridge:*) and give no version boundaries. Real-world priority: below the OOB-write/heap-overflow RCE siblings in the same advisory; treat as a routine patch item, valuable mainly as an information-leak primitive that could be chained with those memory-corruption bugs. |
| Exploit ScenarioDerived | An attacker crafts a malformed image or metadata file that triggers an out-of-bounds read in Adobe Bridge's file parser and delivers it via email, a download, or a shared asset library. When the victim opens the file in Bridge, the read leaks adjacent process memory, which the attacker can exfiltrate or use to defeat memory protections ahead of a paired memory-corruption exploit. No public proof-of-concept is identified at time of analysis, and the local vector plus required user interaction make this an opportunistic, socially-engineered attack rather than a mass-exploitable one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Opening a specially crafted file in Adobe Bridge triggers an out-of-bounds read that leaks potentially sensitive contents of the application's process memory. The flaw is local in nature - an attacker must first deliver a malicious asset and convince a victim to open it in Bridge (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base score 5.5) - so there is no remote or server-side exposure and no authentication requirement. Impact is limited to information disclosure (confidentiality high, integrity and availability unaffected); no public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published advisory APSB26-148 covering the affected Bridge releases.
RemediationAI
Adobe has published advisory APSB26-148 (https://helpx.adobe.com/security/products/bridge/apsb26-148.html), which is the authoritative source for the exact remediated Bridge build and the applicable version ranges; the primary remediation is to update Adobe Bridge to the fixed release named in that advisory and, where the Creative Cloud desktop application is in use, allow it to push the update. The available data does not include a specific fix version number, so do not assume a version - confirm it in the advisory before closing the finding. Until the patched build is deployed, compensating controls should focus on the delivery-to-open chain: restrict user access to untrusted files and block risky formats at email gateways, web proxies, and file shares (effective but can break legitimate creative workflows that depend on third-party assets), enforce the principle of least privilege so Bridge runs as a standard user rather than an administrator (reduces the value of any leaked memory but does not stop the read), and use application allowlisting or endpoint detection tuned to Bridge processes opening files from download or temp directories (adds monitoring overhead and false positives during normal file operations). Rotating or minimizing credentials and tokens that a desktop process could hold in memory limits what an information-disclosure primitive of this class can yield.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-125 (Out-of-bounds Read), meaning Adobe Bridge's file-parsing code does not properly validate a length, offset, or index derived from attacker-controlled input before dereferencing a buffer. Because Bridge is a desktop digital-asset-management application that routinely parses a wide variety of image, RAW, vector, and document formats to generate previews, metadata, and thumbnails, a malformed file can steer its parser past the end of an allocated buffer and copy adjacent heap or stack memory into data the attacker can observe (for example, rendered output, metadata, or error content). CPE records identify the affected package as cpe:2.3:a:adobe:adobe_bridge:* for the Windows and macOS builds, although the feed does not enumerate discrete version ranges, so the authoritative version boundary must be taken from Adobe's advisory. An out-of-bounds read of this class is typically useful as an information-leak primitive - for instance to defeat ASLR or extract pointers - but on its own it does not permit code execution, memory corruption, or data modification, which is consistent with the assessed vector showing only a confidentiality impact.
Know when Adobe Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local desktop file-parse bug needing victim to open a malicious file (AV:L, UI:R, PR:N); out-of-bounds read leaks memory so C:H, I:N, A:N.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user wh
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controll
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of t
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Exploit-DB