EUVD-2026-84773
GHSA-4hfc-j6gj-xh6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Bridge asset file
-
DeliveryDeliver via email or shared library
-
ExploitVictim opens file in Adobe Bridge
-
ExecutionHeap buffer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted malicious file in Adobe Bridge on their local machine (AV:L, UI:R); the malformed file triggers the heap-based buffer overflow during parsing. Limiting factors: the attack is not remotely triggerable without user action, it depends on social engineering to get the target to open the file, and code executes only in the context of the current user (S:U, no privilege escalation). No special product configuration is required beyond having Adobe Bridge installed and the user opening the file. |
| Impact | This is a genuine but non-urgent priority. The CVSS 7.8 (HIGH) is driven by full C:H/I:H/A:H impact, but the vector is explicitly local (AV:L) and requires user interaction (UI:R) - a victim must open a malicious file - so this is a client-side file-parse RCE, not a remotely-triggerable server flaw. PR:N here means no prior authentication to the app is needed, not remote reachability. There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence, so real-world exploitation is currently theoretical rather than observed. Exploitation status: no public exploit identified at time of analysis. The single vendor advisory (Adobe APSB26-148) is self-reported with no independent corroboration, EPSS, or exploitation telemetry. Net: patch in the normal cycle; the UI:R + AV:L gating and lack of exploitation signals make this a lower operational priority than the raw 7.8 suggests, weaponization would depend on social-engineering a target into opening a crafted Bridge asset. |
| Exploit ScenarioDerived | An attacker crafts a malicious file (e.g., an image or asset supported by Adobe Bridge) with a corrupted structure that triggers a heap-based buffer overflow when parsed, and delivers it via email, download, or a shared asset library. When the victim opens the file in Adobe Bridge, the overflow corrupts heap memory and executes attacker-controlled code in the security context of the current user. No public proof-of-concept is available at time of analysis, and the local vector plus required user interaction mean the attacker depends on social engineering to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning the attacker needs no prior privileges but must rely on social engineering to get the target to open a malicious file locally; successful exploitation yields full confidentiality, integrity, and availability impact within the user's own security context, with no privilege escalation to system level. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but non-urgent priority that should be handled through routine vendor patching; Adobe has published an advisory (APSB26-148) with fixed builds.
RemediationAI
Vendor-released patch: apply the Bridge update published in Adobe security advisory APSB26-148 (https://helpx.adobe.com/security/products/bridge/apsb26-148.html); the advisory is the authoritative source for the exact fixed build number for each platform, since no specific fix version is enumerated in the supplied data. Until the update is deployed, the most effective compensating control is to prevent the parsing of untrusted files: block or restrict the handling and automatic preview/thumbnail generation of Bridge-supported file types from untrusted sources, and rely on mail and web gateways plus endpoint protections to quarantine incoming files of those types before a user can open them. Restricting the file types that can be opened in Bridge (or blocking file-type associations for high-risk formats) reduces the parsing surface but degrades normal asset-management workflows, and disabling preview/thumbnail generation for untrusted directories specifically avoids the automatic parsing path at the cost of a less useful browsing experience. Educating users not to open unexpected attachments and running Bridge under a least-privilege, non-administrative account are worthwhile because exploitation is confined to the current user's context (S:U), so least privilege limits the attacker's reach; however, these are behavioral and containment measures only and do not eliminate the memory-corruption bug. Note that no public exploit code is known at time of analysis, so exploitation would require attacker-developed tooling and successful social engineering, but patching should still be scheduled promptly given the arbitrary-code-execution impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a classic heap-based buffer overflow (CWE-122), a root-cause class in which a program allocates a heap buffer of one size and then writes or copies more data than that buffer can hold. In Adobe Bridge, the trigger is file parsing: a malformed, attacker-crafted file is opened by the user and the parsing logic mishandles length or count fields, corrupting adjacent heap memory. Heap corruption of this kind is attractive to attackers because it frequently permits controlled overwrites of heap metadata or function pointers, which can be converted into arbitrary code execution without requiring elevated privileges. Adobe Bridge is a digital asset management and file-browsing application that ingests a wide variety of image and document formats, and this broad format-parsing surface is exactly where such memory-safety flaws occur. The supplied CPE entries (cpe:2.3:a:adobe:adobe_bridge:*:*:*:*:*:*:*:*) identify Adobe Bridge as the affected product across the vendor-documented version ranges, which are not enumerated in the available data. The vector's AV:L and UI:R components confirm that the malicious file must be present on, and opened from, the local machine, and that no remote network vector exists for this specific flaw.
Know when Adobe Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parse RCE: AV:L and UI:R because a victim must open a malicious file; PR:N as no app authentication is needed; full C/I/A impact as current-user code execution, S:U with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Bridge, widely deployed across creative, marketing, and design functions, contains a memory-corruption flaw that allows code execution under the logged-in user's own credentials whenever an employee opens a malicious file - a realistic outcome given the volume of shared creative assets these teams exchange daily. Leadership should care because a single successful attack could expose, alter, or destroy the user's local and network-accessible project files and credentials, while no vendor-released patch has been identified at time of analysis. The risk is real but opportunistic rather than targeted: no public exploit code exists and the issue is not confirmed actively exploited (CISA KEV), so this is best managed through disciplined patching, file-handling restrictions, and user awareness rather than emergency escalation.
No vendor-released patch identified at time of analysis. Interim mitigations: block or quarantine externally sourced Adobe Bridge file types (PSD, AI, PDF, INDD) at email and web gateways; enforce least-privilege local accounts so a compromised session cannot reach administrative resources; apply application allowlisting to restrict execution to approved binaries; enable EDR alerting on suspicious child processes and file writes spawned by Adobe Bridge; disable or restrict automatic preview and thumbnail rendering of untrusted files; and train creative staff to treat unsolicited or unexpected design files as potential social-engineering lures. Track Adobe advisory APSB26-148 for fixed builds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controll
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of t
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Exploit-DB