EUVD-2026-44496
GHSA-8p4v-4472-qp82
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open attack requiring victim interaction (AV:L/UI:R), no attacker privileges needed to craft the file (PR:N), and code execution yields full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. The flaw is local and requires user interaction, carrying a CVSS 7.8 (High) score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Adobe Bridge is a digital-asset management application used to organize, preview, and batch-process media files (images, video, PSD, camera raw, and other creative formats) across the Adobe Creative Cloud suite. The root cause is an integer overflow or wraparound (CWE-190): during parsing of a file, an arithmetic operation on a size, length, or index value exceeds the storage width of its integer type and wraps, producing an undersized allocation or an out-of-bounds computation that is subsequently used for a memory write. This corrupts memory in a way that can be steered toward control-flow hijack and arbitrary code execution. The affected component is Adobe's own file-format parsing logic within Bridge rather than a shared third-party library, per the vendor CPE cpe:2.3:a:adobe:adobe_bridge.
RemediationAI
Apply the vendor update: consult Adobe security bulletin APSB26-81 (https://helpx.adobe.com/security/products/bridge/apsb26-81.html) and upgrade Adobe Bridge to the fixed release listed there via the Creative Cloud desktop application's update mechanism - the exact fixed version is defined in that advisory and was not included in the provided data, so it should be taken directly from Adobe. Patch status: Patch available per vendor advisory. Until updating, reduce exposure by not opening Bridge files (or media assets) from untrusted or unsolicited sources, restrict which file types are handled by Bridge, and run Bridge under a least-privileged user account so that code execution 'in the context of the current user' yields minimal privileges; the trade-off is reduced convenience when handling shared assets. Because the attack requires opening a malicious file, email/file-gateway filtering and user awareness training are effective compensating controls.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affecte
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-o
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerabilit
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by ent
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the c
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim op
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today