Adobe Bridge EUVD-2026-100621

Exploitation requires a local attack vector (AV:L) with mandatory user interaction (UI:R): a victim running an affected Adobe Bridge version (≤15.1.8 in the 15.x branch or ≤16.0.7 in the 16.x branch) must be tricked into opening or previewing an attacker-crafted malicious file. No authentication or elevated privileges are needed (PR:N), and attack complexity is low (AC:L) once the file is opened. The key limiting factor is that the attack cannot occur remotely or automatically - it depends entirely on social engineering to induce the file-open action, and succeeds only against the vulnerable versions listed, so patched installations are not exposed.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local attack vector requiring victim interaction, not remote exploitation - the attacker cannot reach the vulnerability over a network and instead depends on social engineering to get a user to open a malicious file. The CWE-787 out-of-bounds write yielding arbitrary code execution in the current user's context is a classic memory-corruption pattern consistent with the RCE/Buffer Overflow/Memory Corruption tags. No EPSS score, KEV listing, SSVC decision data, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified; the absence of a KEV entry means there is no public evidence of active exploitation, and no public exploit was identified at time of analysis. Net assessment: a real, patch-worthy flaw whose practical risk is gated by the user-interaction requirement, making it most relevant to targeted phishing/malicious-document scenarios rather than mass automated exploitation. Note the mandatory user interaction means it is not self-propagating.

An attacker crafts a malicious file (e.g., a document or image Adobe Bridge will parse) and delivers it via email or a watering-hole download, then convinces a creative-professional victim to open or preview it in Adobe Bridge. Parsing triggers the out-of-bounds write, corrupting memory and executing attacker-controlled code with the victim's privileges. No public exploit code was identified in the provided data, and the AV:L/UI:R metrics mean the attack hinges on social engineering rather than automated remote delivery.