EUVD-2026-84778
GHSA-mj89-mv3m-vhxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Bridge-parsable file
-
DeliveryDeliver via phishing or shared asset
-
ExploitVictim opens file in Bridge
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied malicious file within Adobe Bridge (UI:R) on the local system (AV:L). There is no network-facing or unauthenticated-service exposure - the PR:N reflects that no application login is needed, but the attack still depends on social engineering to deliver and open the crafted file. Limiting factors: mandatory user interaction, local file handling, and the requirement that the target actually runs a vulnerable Adobe Bridge build; code executes only with the privileges of the current user, not elevated/system context. Affected version range is unspecified in the source data (CPE wildcard). |
| Impact | This is a client-side, local-vector out-of-bounds write (CWE-787) in Adobe Bridge, rated 7.8 (HIGH) by Adobe. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms it is NOT remotely exploitable in the network sense - despite PR:N, exploitation is gated behind mandatory user interaction (UI:R): a victim must open a maliciously crafted file. This dramatically lowers real-world risk versus a true remote-unauthenticated RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The high CVSS is driven entirely by full CIA impact (C:H/I:H/A:H = arbitrary code execution in the current user's context), not by ease of delivery. Net: this is a plausible but conditional threat best treated as a routine patch priority (social-engineering/malicious-document dependent) rather than an emergency - comparable to typical Adobe creative-app file-parsing memory-corruption bugs. |
| Exploit ScenarioDerived | An attacker crafts a malicious file (e.g. an image, metadata, or asset file that Bridge parses) that triggers an out-of-bounds write when opened. The attacker delivers it via phishing email, a shared design asset, or a compromised download, and social-engineers a Bridge user into opening it. On open, the parser writes past a buffer boundary and the attacker achieves arbitrary code execution in the context of the current user. No public POC or exploit code is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Adobe rates the flaw 7.8 (HIGH) under CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local, client-side vector that requires user interaction rather than any network-facing or service exposure, with PR:N simply meaning no application authentication is needed while social engineering remains a prerequisite. No public exploit code or confirmed active exploitation was identified from the available intelligence at time of analysis, and the affected version range is unspecified in the source data, so any deployed Adobe Bridge build should be assumed potentially vulnerable until the vendor advisory is reconciled against the installed release.
RemediationAI
Apply the fixed Adobe Bridge release documented in Adobe security advisory APSB26-148 (https://helpx.adobe.com/security/products/bridge/apsb26-148.html); the provided data does not include an exact fix version number, so the advisory's affected-and-fixed version table must be used to determine the correct update target, and users should also update via the Creative Cloud desktop app's update mechanism or a managed enterprise package. Until patched, compensating controls should focus on the fact that exploitation requires a victim to open an attacker-supplied file: block or quarantine suspicious file attachments and downloads at the email/web gateway, and warn creative staff not to open Bridge asset files or media received from untrusted sources. Additional hardening includes running Bridge under a low-privilege, non-administrative account and, where operationally feasible, in a sandboxed or virtualized workstation so that code execution is contained to a disposable environment - the trade-off being reduced convenience for file handling and potential incompatibility with plugins, GPU acceleration, or network asset libraries. Application allowlisting and EDR rules that flag Bridge spawning child processes (for example Office, scripting hosts, or command shells) can detect post-exploitation behavior, though they generate false positives during legitimate plugin or export workflows. Keep OS-level exploit mitigations (ASLR, DEP) enabled as a defense-in-depth measure; note that these raise exploitation difficulty but do not remediate the underlying out-of-bounds write.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Bridge is a creative-asset management and file-browsing application that parses, renders thumbnails and previews for, and indexes a wide range of media and document formats. Handling that breadth of untrusted input means Bridge contains numerous format parsers, and CWE-787 (out-of-bounds write) is the classic consequence of a parser trusting an attacker-controlled length, offset, or index derived from file contents without adequately validating it against the size of the destination buffer. Such a write lands past the end of a heap or stack allocation, corrupting adjacent memory and, in the typical exploitation path, letting an attacker overwrite pointers or metadata to redirect execution - in this case to code running with the privileges of the user who opened the file. The CVSS vector confirms the root characteristics: AV:L and UI:R mean the malicious file must be delivered to and opened on the local system, PR:N means no login to an exposed service is involved, S:U means the impact stays within the application's security scope, and the H/H/H CIA triad reflects potential full compromise of confidentiality, integrity, and availability in that user context. The CPE entries provided are wildcarded (cpe:2.3:a:adobe:adobe_bridge:*:*:*:*:*:*:*:*), so the exact build range is not resolvable from this data alone.
Know when Adobe Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parse RCE: AV:L and UI:R because a victim must open a crafted file, PR:N as no app auth is needed, full C/I/A from arbitrary code execution in current-user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Bridge is affected by a high-severity out-of-bounds write (CVE-2026-75658) that could let an attacker execute arbitrary code as the current user when a victim opens a crafted file. This risk primarily affects creative and design teams who regularly open external files; with no public exploit identified and no vendor patch available, the organization must rely on user awareness and endpoint controls. Leadership should prioritize protecting these users to prevent potential data compromise or unauthorized system access.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict opening untrusted files, disable unnecessary file preview handlers, enforce application allowlisting, use EDR to detect exploitation attempts, apply least privilege, and train users to recognize social engineering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user wh
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controll
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a craft
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Exploit-DB