EUVD-2026-44500
GHSA-ch5v-r2g3-8g6x
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing bug needing a victim to open a malicious file (AV:L/UI:R), no prior auth (PR:N), and code execution as the user gives full C/I/A within an unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a victim into opening a maliciously crafted file that triggers an untrusted pointer dereference (CWE-822). The flaw is local and file-based, requiring user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation yields full impact on confidentiality, integrity, and availability limited to the privileges of the user running Bridge.
Technical ContextAI
Adobe Bridge is a digital-asset-management companion application to Adobe Creative Cloud used to browse, organize, and preview media files (images, video, PDFs, camera raw, and other creative assets). The root cause is classified as CWE-822 (Untrusted Pointer Dereference), meaning the application takes a pointer value derived from attacker-controlled file data and dereferences it without validating that it points to a legitimate, safe memory location. When Bridge parses a malformed file, the corrupted pointer can redirect execution or memory access, allowing an attacker to steer control flow toward attacker-supplied code. The CPE data identifies the affected product only as cpe:2.3:a:adobe:adobe_bridge with wildcard versions, so the precise fixed build must be taken from the Adobe advisory rather than the CPE string.
RemediationAI
Apply the update referenced in Adobe security bulletin APSB26-81 (https://helpx.adobe.com/security/products/bridge/apsb26-81.html); the input data does not contain an exact fixed version number, so consult that advisory for the precise patched build and update Adobe Bridge through the Creative Cloud desktop application. Until patched, the primary compensating control is user-side: do not open Adobe Bridge files or asset packages received from untrusted or unverified sources, and treat unsolicited creative-asset files (especially from email or downloads) as suspicious, since exploitation requires the victim to open a malicious file. Where feasible, restrict Bridge usage to trusted content and run it under least-privilege user accounts so that successful code execution is confined to a low-privilege context; the trade-off is reduced convenience for teams that routinely exchange asset files externally.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affecte
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a malic
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-o
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerabilit
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by ent
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the c
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim op
Same weakness CWE-822 – Untrusted Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today