EUVD-2026-65680
GHSA-483g-5qp2-mhww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XD file with oversized buffer payload
-
DeliveryDeliver file via phishing or compromised file-sharing channel
-
ExploitVictim opens crafted file in Adobe XD
-
ExecutionBuffer overflow corrupts memory in parser context
-
ImpactArbitrary code executes as current OS user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open a specially crafted Adobe XD file on a system with a vulnerable version of Adobe XD installed - this is the sole precondition (UI:R in CVSS). No special application configuration, feature flag, or elevated privilege is required beyond a standard user installation. The attack vector is local (AV:L), meaning the malicious file must be present on or delivered to the victim's local filesystem; remote unauthenticated exploitation over a network without file delivery is not possible. Exploitation is bounded by the requirement to socially engineer the victim into opening the file, and resulting code execution is limited to the current user's OS privilege level (S:U) - administrative or SYSTEM-level compromise is not directly achievable unless the victim is running as an administrator. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly captures a local file-open scenario: attack complexity is low once the victim opens the file, no privileges are required on the attacker's side, but user interaction is mandatory - a genuine friction point. EPSS data was not provided, so exploitation probability cannot be quantified. KEV status is absent, meaning CISA has not confirmed active exploitation. No POC was referenced. Real-world risk is meaningful for design and creative teams who routinely receive and open files from external collaborators, making social engineering or supply-chain file poisoning the realistic threat model. The wildcard CPE suggests no version is currently safe, increasing urgency to patch. Overall, this is a high-priority patch for affected user populations but not an emergency requiring immediate emergency response absent KEV confirmation. |
| Exploit ScenarioDerived | An attacker crafts a malicious Adobe XD project file that embeds an oversized payload designed to overflow a parser buffer and redirect execution. The file is delivered to a designer via a phishing email, a compromised file-sharing link, or a poisoned design asset repository. When the victim opens the file in Adobe XD, the buffer overflow is triggered and the attacker's shellcode executes with the victim's user-level privileges, enabling data exfiltration, malware installation, or lateral movement within the user's session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Adobe XD's file parser contains a classic buffer overflow (CWE-120) that enables arbitrary code execution at the privilege level of the current user when a victim opens a maliciously crafted XD file. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact offset by a local attack vector and mandatory user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a serious but not imminently weaponized code-execution vulnerability.
RemediationAI
Patch available per vendor advisory - consult Adobe security bulletin APSB26-125 at https://helpx.adobe.com/security/products/xd/apsb26-125.html for the specific fixed version and update instructions; an exact patched version number was not included in the available intelligence and should be confirmed directly from that advisory before deployment. Where immediate patching is not feasible, restrict Adobe XD users from opening files received from untrusted or external sources - this directly eliminates the UI:R exploitation pathway. Organizations can enforce this by blocking XD file-type attachments (.xd) at email and file-sharing gateways; note this may disrupt legitimate design collaboration workflows and requires stakeholder coordination. Until patched, users should verify file provenance before opening any design asset.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-120 (Buffer Copy without Checking Size of Input) describes a failure to validate input length before writing to a fixed-size memory buffer, enabling heap or stack corruption. Adobe XD is Adobe's vector graphics and UX/UI design application; the CPE cpe:2.3:a:adobe:adobe_xd:*:*:*:*:*:*:*:* uses a wildcard version, indicating all tracked versions of the application are considered affected. The vulnerability is triggered during file parsing - a common attack surface in creative applications that must deserialize complex proprietary or open formats. Code execution occurs within the security context of the logged-in user, consistent with the CVSS S:U (Unchanged Scope) metric, meaning the attacker gains no elevation beyond the victim's own OS session.
Know when Adobe Xd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally requiring active user interaction (AV:L/UI:R); no attacker privileges needed; full RCE impact scoped to victim's user session (S:U/C:H/I:H/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
Executive ViewAI
Adobe XD contains a buffer overflow vulnerability (CVE-2026-71399, CVSS 7.8 High) enabling arbitrary code execution when users open maliciously crafted XD project files. This directly threatens design and creative teams; no public exploit identified at time of analysis, but the lack of a vendor patch means the attack surface remains exposed. Immediate mitigation is required to prevent potential exploitation through social engineering or file distribution vectors.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict XD file access to trusted internal sources only; disable XD on non-critical systems; enforce strict email and web content filtering; deploy behavioral monitoring and EDR with exploit-detection capabilities; maintain least-privilege user accounts; conduct regular security awareness training; monitor XD file-opening events for suspicious patterns; and consider sandboxed or virtualized execution environments for XD workflows.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB