EUVD-2026-84775
GHSA-3g7m-9cvw-75rc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Bridge-compatible file
-
DeliveryDeliver via email or download
-
ExploitVictim opens file in Bridge
-
ExecutionStack buffer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted file in Adobe Bridge (UI:R) on the local machine (AV:L); there is no network-triggerable path and no authentication is involved. The limiting factors are strong: the attacker must first deliver the file and socially engineer the target into opening it in Bridge specifically, and successful code execution runs only with the current user's privileges (S:U, no privilege escalation). No non-default configuration is required - any installation that opens the malicious file is affected. |
| Impact | This is a client-side, file-parsing memory-corruption bug typical of Adobe's creative-app advisories. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent and I agree with it: exploitation is local (the attacker cannot reach it over the network - the victim must obtain and open a malicious file) and requires user interaction, which materially limits real-world risk despite the C:H/I:H/A:H impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC record supplied. Net: a legitimately HIGH-impact code-execution bug but NOT an urgent mass-exploitation priority - it depends on social engineering (deliver-and-open) and yields only current-user privileges, not SYSTEM/root or scope change. Prioritize normal patch cycles unless Bridge users routinely open untrusted files. |
| Exploit ScenarioDerived | An attacker crafts a malformed Bridge-supported asset/metadata file and delivers it via email, download, or a shared asset library. When a victim opens the file in Adobe Bridge, a stack-based buffer overflow is triggered during parsing, allowing arbitrary code execution in the context of the current user. No public proof-of-concept is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of the user who opens it (CVSS 7.8, CWE-121). The attack is local and requires user interaction - an attacker must deliver a malicious file and convince the victim to open it in Bridge (AV:L/AC:L/PR:N/UI:R/S:U), after which code runs in the current user's context without privilege escalation. Impact is limited by the strong social-engineering and delivery prerequisites, and no public exploit identified at time of analysis; risk is concentrated in users who routinely open files from untrusted or external sources.
RemediationAI
Patch status: Patch available per vendor advisory - Adobe's bulletin APSB26-148 (https://helpx.adobe.com/security/products/bridge/apsb26-148.html) lists the corrected Bridge release for each affected platform; update through the Creative Cloud desktop app or the standalone installer and cite the exact fixed version from that advisory rather than assuming one. Until the update is applied, the most effective compensating control is procedural: do not open Bridge files, previews, or asset packages from untrusted or unexpected sources, and treat unsolicited files as hostile. Where Bridge is not required for a workflow, removing or not deploying it eliminates the attack surface entirely; restricting Bridge usage to a hardened, non-privileged account limits post-exploitation impact but does not prevent the overflow (S:U means no privilege escalation, so least-privilege execution is a real but partial mitigation). Blocking or stripping untrusted file types at email and web gateways reduces delivery of the lure file, though it cannot stop files brought in on removable media or shared drives. Enabling OS-level exploit mitigations (ASLR, DEP/CFG, and vendor EDR with stack-pivot and heap/stack corruption detections) raises the bar for reliable exploitation but is not a substitute for the vendor patch. Note that the trade-off for any file-blocking or application-allowlisting measure is reduced asset-management functionality for legitimate creative workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Bridge is Adobe's digital asset management and file-browsing application, which parses a wide range of image, document, and metadata formats (including thumbnails, previews, and XMP sidecar data) to render previews and asset information. The flaw is CWE-121 (Stack-based Buffer Overflow): a fixed-size stack buffer is written past its bounds while handling attacker-controlled file data, corrupting adjacent stack memory (saved registers, return addresses) in a way that can be steered toward arbitrary code execution. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms the trigger is local, needs no credentials, requires the victim to open the malicious file, and yields high confidentiality, integrity, and availability impact confined to the current user's security scope (S:U). CPE entries for adobe:adobe_bridge marked with wildcard versions indicate the advisory covers a version range rather than a single build.
Know when Adobe Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open trigger gives AV:L/UI:R with no auth (PR:N); stack overflow yields full current-user code execution (C:H/I:H/A:H) without scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Bridge is affected by a high-severity local code-execution vulnerability (CVE-2026-75676) that can let a malicious file run code in the context of the user who opens it, with no public exploit identified at time of analysis. This primarily affects creative, marketing, and operations staff who routinely open files from external or untrusted sources, creating a risk of data theft, malware installation, and downstream lateral movement. Because no vendor-released patch identified at time of analysis, leadership should prioritize reducing exposure through user controls and monitoring until Adobe issues a fix.
No vendor-released patch identified at time of analysis. Interim mitigations include instructing users not to open untrusted files in Adobe Bridge, restricting Bridge usage to trusted file sources, enforcing least privilege, enabling EDR and application allowlisting, filtering malicious attachments at email and web gateways, and monitoring for unusual processes spawned by Bridge. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user wh
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controll
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of t
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Exploit-DB