Adobe Bridge EUVD-2026-44496

Exploitation requires that a victim running Adobe Bridge opens (or previews) an attacker-crafted malicious file - this user interaction is mandatory (CVSS UI:R) and is the primary limiting factor. The attack vector is local (AV:L): there is no network-facing service, so the attacker must get the malicious file onto the victim's system and induce them to open it in Bridge. No authentication or elevated privileges are needed on the attacker's part to craft the file (PR:N), and attack complexity is low (AC:L) once the file is opened. Code executes only with the privileges of the current user, so a low-privilege user account limits the resulting impact.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) frames this as a client-side, local attack: exploitation is not remote-over-network but requires the victim to open an attacker-supplied file, which is why the vector is AV:L with UI:R despite PR:N. The high C/I/A impacts reflect full code execution as the logged-in user. There is no EPSS score provided, no SSVC decision data, no POC, and no CISA KEV listing, so all signals point to a serious-but-not-actively-exploited memory-safety bug typical of Adobe's periodic security bulletins. The realistic risk is moderate and depends on social engineering to deliver the malicious file; it is not a wormable or mass-exploitable network vulnerability. Missing data to note: EPSS probability is absent, and no independent confirmation of exploitation exists beyond the vendor advisory.

An attacker crafts a malicious asset file (e.g., an image or media file) whose header values trigger the integer overflow in Bridge's parser, then delivers it via email, a shared drive, or a download disguised as a legitimate creative asset. When the victim opens or previews the file in Adobe Bridge, the overflow corrupts memory and executes attacker-controlled code with the victim's privileges. No public POC or exploit code has been identified at time of analysis.