Adobe Bridge EUVD-2026-44500

Exploitation requires the attacker to deliver a specially crafted malicious file and have a victim open it in Adobe Bridge on the local machine - the CVSS vector AV:L/UI:R confirms local access plus mandatory user interaction. There is no network-triggerable path and no privilege escalation: code runs only in the context of the current user (S:U), so an unprivileged user opening the file yields only unprivileged execution. Limiting factors are the dependence on social engineering to get the file opened, the absence of any auto-exploitation vector, and PR:N meaning no prior authentication to Bridge is needed beyond the user simply running the application.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High), driven by high impact across all three security properties but constrained by a local attack vector and required user interaction - the victim must actively open a malicious file. No EPSS score was provided in the input, and no SSVC decision metrics or KEV listing accompany this CVE, so there is no signal of automatable or active exploitation. This is a realistic but not urgent priority: it is not remotely triggerable, cannot self-propagate, and depends on social engineering to deliver the malicious file. In practice its risk profile matches the broad class of Adobe client-side file-parsing bugs patched in routine Patch-Tuesday-style updates - meaningful for targeted attacks against creative/media users, but not a mass-exploitation threat absent evidence of a public exploit.

An attacker crafts a malicious asset file that corrupts a pointer parsed by Adobe Bridge and delivers it to a target via email, a shared drive, or a downloaded asset bundle. When the victim opens the file in Bridge, the untrusted pointer dereference is triggered and attacker-controlled code executes with that user's privileges. No public exploit code has been identified at time of analysis, so this would currently require the attacker to develop their own exploit.