EUVD-2026-84772
GHSA-qqr4-7rhm-w46v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious asset file
-
DeliveryDeliver via email or shared drive
-
ExploitVictim opens file in Bridge
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open (or preview) a maliciously crafted file inside Adobe Bridge; the out-of-bounds write is reached through Bridge's file/asset parsing. Limiting factors: the vector is local (AV:L) with no network reach, code runs only in the current user's context (S:U, no privilege escalation), and mandatory user interaction (UI:R) plus the need to socially engineer file delivery mean there is no unattended or remote exploitation. Only systems with Adobe Bridge installed where users open untrusted asset files are exposed. |
| Impact | This is a client-side, local-vector memory-corruption flaw (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) in Adobe Bridge, self-reported by Adobe in advisory APSB26-148. The CVSS base is driven by full C/I/A impact (arbitrary code execution in the current user's context), but AV:L and UI:R sharply constrain real-world risk: the attacker cannot reach the target over a network and must convince a victim to open a malicious file, so exploitation is user-driven and one-victim-at-a-time rather than scalable. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reading: exploitation=none, automatable=no (requires human file-open), technical impact=total. Net: a genuinely high-CVSS bug but LOW immediate operational urgency absent evidence of exploitation - patch on a normal Adobe Creative Cloud cadence, prioritizing hosts where analysts routinely open untrusted asset files. |
| Exploit ScenarioDerived | An attacker crafts a malicious asset file (e.g., an image or metadata file that Bridge parses) that triggers the out-of-bounds write, then delivers it via email, a shared drive, or a download and lures a creative-professional victim into opening or previewing it in Adobe Bridge. When Bridge parses the file, the OOB write corrupts memory and executes attacker code with the victim's privileges. No public proof-of-concept is identified in the provided data; exploitation requires local user interaction (AV:L/UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing memory corruption that may lead to arbitrary code execution in the context of the current user. Only systems with Bridge installed where users routinely open untrusted asset files are exposed; the vector is local (AV:L) with mandatory user interaction (UI:R), so there is no unattended or remotely reachable attack path and no privilege escalation beyond the logged-in user (S:U). Adobe self-reported the flaw in advisory APSB26-148 and rates it CVSS 3.1 7.8 HIGH; no public exploit code was identified at time of analysis and there is no KEV status confirming active exploitation.
RemediationAI
Apply the fix published in Adobe's security advisory APSB26-148 at https://helpx.adobe.com/security/products/bridge/apsb26-148.html; the advisory is the authoritative source for the patched build, and this input data does not enumerate an exact fixed version number, so patch available per vendor advisory rather than to a version stated here. Until the update is deployed, reduce exposure by treating Bridge as an untrusted-file handler: do not open, preview, or auto-generate thumbnails for asset files from unverified sources, and disable or restrict Bridge's automatic preview/thumbnail generation for network-shared or download folders - the trade-off is degraded browsing convenience and slower asset triage. Additional compensating measures include routing suspicious creative assets through a sandboxed or non-production workstation first, stripping external senders' ability to deliver Bridge-openable files via mail gateways and browser download policies, and monitoring for unexpected process crashes or child processes spawned by Bridge, since memory-corruption exploitation often produces crash artifacts; none of these controls remove the flaw, so the vendor update remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a memory-safety defect classified as CWE-787 (out-of-bounds write): Bridge's parsing of a crafted asset/file structure computes a size or index incorrectly and writes past the end of a heap or stack buffer, corrupting adjacent memory. In the typical exploitation pattern for this class, the corrupted data lets an attacker influence control data and redirect execution to attacker-supplied code, which runs with the privileges of the Bridge process - that of the current user. The supplied CPE entries (cpe:2.3:a:adobe:adobe_bridge:*:*:*:*:*:*:*:*, listed twice) use wildcard versions, so the data does not pin the defect to a specific build or platform; the advisory is the authoritative source for the exact version window. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms a local attack vector with no privileges required (PR:N) but mandatory victim interaction (UI:R), unchanged scope, and high confidentiality, integrity, and availability impact within the user's security context.
Know when Adobe Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parse RCE: AV:L and UI:R because a victim must open a malicious file, PR:N as no prior auth is needed, full C/I/A from code execution in the current user's context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Bridge, installed on creative, marketing, and design workstations where staff routinely open asset files received from clients, agencies, and public sources, contains a memory-corruption flaw (CVE-2026-75663) that could allow a malicious file to execute code under the logged-in user's account. The exposure is confined to individual endpoints rather than shared or remote infrastructure, since an employee must personally open or preview the crafted file and the flaw grants no privileges beyond that user. Leadership should care because there is no vendor patch available, and the file-opening behaviour that triggers the flaw is core to how these teams work, creating a sustained window in which an unremediated endpoint could expose locally stored creative assets and cached credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: prohibit opening or previewing untrusted asset files directly in Adobe Bridge and route external creative files through an isolated review environment; enable endpoint detection and response monitoring for Bridge process behaviour; block or quarantine suspicious asset formats at email and web gateways; remove local administrative rights from Bridge workstations where operationally feasible; and maintain daily review of Adobe advisory APSB26-148 for a fixed version.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user wh
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controll
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of t
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Exploit-DB