Adobe Dimension EUVD-2026-100573

Exploitation requires LOCAL access to the system and the ability to place a malicious search-path element (library/DLL) in a directory that Adobe Dimension resolves at load time; code then executes only when a victim actively launches the Dimension application (UI:R). Limiting factors: the attacker must already have local user-level filesystem write access to an attacker-influenceable search directory, the victim must run the vulnerable application (versions 0 through ≤4.1.8), and there is no remote or unauthenticated path. This confines realistic exploitation to multi-user, shared, or pre-compromised hosts rather than opportunistic remote attacks.

This is a CWE-427 Uncontrolled Search Path Element (DLL/library hijacking) flaw in Adobe Dimension, reported by Adobe PSIRT with a vendor CVSS of 8.6. The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H shows the dominant risk factors are LOCAL attack vector (AV:L) and REQUIRED user interaction (UI:R) - the victim must launch the application after a malicious search-path element (e.g., a planted DLL) is already present on the filesystem. The high 8.6 score is driven largely by the changed scope (S:C) and full C/I/A impact, NOT by remote reachability. Contrast the signals: CVSS severity is HIGH, but the real-world exploitation signals are weak - no EPSS score was provided, this is NOT on the CISA KEV list, and no public POC is referenced. There is therefore no evidence of active exploitation or widespread automated attacks; the flaw requires pre-existing local file placement plus a user action, which materially limits practical risk. This is best treated as a 'high-CVSS but constrained-real-risk' issue for most environments: patch in normal cycles, prioritize only where Dimension runs on shared or multi-user workstations. Note a mild tension worth verifying: PR:N is claimed despite the attack requiring the attacker to drop a file in a path the application searches - plausible on a shared machine but dependent on writable directory permissions.

An attacker with local user access plants a malicious library/DLL in a directory that Adobe Dimension searches when loading components. When the victim later launches Dimension, the application loads the attacker-controlled file instead of the legitimate one, executing arbitrary code in the victim's user context. No public exploit code is identified at time of analysis, and exploitation depends on the victim running the application (UI:R).