Adobe Dimension EUVD-2026-100570

Exploitation requires a victim to open an attacker-supplied malicious file in Adobe Dimension version 4.1.8 or earlier; it cannot be triggered remotely or without this user action. The specific prerequisite is local processing of a crafted file by the Dimension application (AV:L, UI:R). Limiting factors: the attacker must socially engineer file delivery and opening, no application authentication or privileges are needed (PR:N) but code runs only in the opening user's context (S:U, no privilege escalation), and only vulnerable builds ≤4.1.8 are affected. Default configuration is sufficient - no special feature or setting must be enabled - the constraint is purely the user-interaction delivery step.

This is a credible but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) is local, not network: exploitation requires the attacker to deliver a malicious file AND for a victim to open it in Adobe Dimension, so there is no remote-triggerable, unauthenticated-over-the-wire path despite PR:N. PR:N here means no application privileges are needed, but the UI:R requirement (victim must open a crafted file) is the dominant limiting factor. Impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H) because successful exploitation yields arbitrary code execution, but strictly in the context of the current user - there is no scope change (S:U) or privilege escalation to SYSTEM/root. No EPSS score, CISA KEV listing, or POC was provided in the input; therefore exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals: the single reported vector (local, user-interaction RCE via malicious file) is internally consistent with a client-side file-parsing stack overflow. The combination of required user interaction, a comparatively niche 3D-design product, and absence of any exploitation evidence places this well below internet-facing server flaws in prioritization, though it still warrants patching for workstations running Adobe Dimension.

An attacker crafts a malicious Dimension-compatible file (e.g., a 3D asset or project file) with malformed data that overflows a fixed-size stack buffer during parsing, and distributes it via email, a shared drive, or a download. When a victim opens the file in a vulnerable Adobe Dimension build (≤4.1.8), the overflow overwrites the stack and allows arbitrary code execution in the victim's user context. No public exploit code was identified in the provided data; the local vector (AV:L) and required user interaction (UI:R) mean this depends on social engineering rather than remote triggering.