EUVD-2026-56542
GHSA-hp27-5w84-96wf
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network delivery without auth or interaction (PR:N, UI:N); AC:H reflects attacker-uncontrollable memory state per description; full C/I/A from RCE; scope unchanged.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
AnalysisAI
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) describes a memory corruption condition in which an application writes data past the end of a heap-allocated buffer, corrupting adjacent allocator metadata or data structures. In Adobe ColdFusion - a CFML-driven application server that uses JVM and native components for request processing - heap overflow vulnerabilities typically originate in native parsing routines or third-party libraries handling user-supplied content such as file uploads, serialized objects, or crafted HTTP payloads. Successful heap corruption can overwrite function pointers or vtable entries, redirecting execution flow to attacker-controlled code. The affected products are confirmed by NVD CPE strings as cpe:2.3:a:adobe:coldfusion_2023:*:*:*:*:*:*:*:* and cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:*, covering all sub-versions of both the 2023 and 2025 release lines.
RemediationAI
Apply the patched builds documented in Adobe Security Bulletin APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html) as the primary remediation; the bulletin is the authoritative source for exact fix build numbers for both ColdFusion 2023 and 2025, as specific patched versions were not included in available intelligence. If an immediate patch window cannot be scheduled, restrict inbound network access to ColdFusion's HTTP/S connector ports (commonly 8500 and 443) via firewall ACL or web application firewall rules, limiting exposure to trusted IP ranges only - note this does not eliminate risk from compromised internal hosts. Disabling non-essential binary or file-processing features at the ColdFusion Administrator level may reduce the exploitable attack surface, but will affect application functionality and should be tested in staging before production use. Patching remains the only reliable remediation; compensating controls only raise the attacker's bar consistent with the existing AC:H constraint.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today