Adobe Bridge
Monthly
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Adobe rates the flaw 7.8 (HIGH) under CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local, client-side vector that requires user interaction rather than any network-facing or service exposure, with PR:N simply meaning no application authentication is needed while social engineering remains a prerequisite. No public exploit code or confirmed active exploitation was identified from the available intelligence at time of analysis, and the affected version range is unspecified in the source data, so any deployed Adobe Bridge build should be assumed potentially vulnerable until the vendor advisory is reconciled against the installed release.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution with the privileges of the user running Bridge (CVE-2026-75649, CVSS 7.8). The attack is local-host only and depends on user interaction - a victim must open an attacker-supplied malicious file - so it cannot be triggered remotely or automatically, and code executes in the current user's context with no privilege escalation (AV:L/PR:N/UI:R/S:U). At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, but because the advisory is vendor-published and the flaw is a memory-corruption RCE class, it should be treated as a genuine but conditional risk requiring social engineering to deliver.
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of the user who opens it (CVSS 7.8, CWE-121). The attack is local and requires user interaction - an attacker must deliver a malicious file and convince the victim to open it in Bridge (AV:L/AC:L/PR:N/UI:R/S:U), after which code runs in the current user's context without privilege escalation. Impact is limited by the strong social-engineering and delivery prerequisites, and no public exploit identified at time of analysis; risk is concentrated in users who routinely open files from untrusted or external sources.
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controlled code to run with the privileges of the current user. The issue is scored 7.8 (HIGH) and is a client-side, file-format-triggered flaw with a local attack vector and mandatory user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); the attacker does not authenticate to the product, but delivery depends entirely on social engineering the victim into opening the malicious file. Only unpatched Adobe Bridge versions addressed by vendor advisory APSB26-148 are affected, and no public exploit identified at time of analysis.
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning the attacker needs no prior privileges but must rely on social engineering to get the target to open a malicious file locally; successful exploitation yields full confidentiality, integrity, and availability impact within the user's own security context, with no privilege escalation to system level. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but non-urgent priority that should be handled through routine vendor patching; Adobe has published an advisory (APSB26-148) with fixed builds.
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing memory corruption that may lead to arbitrary code execution in the context of the current user. Only systems with Bridge installed where users routinely open untrusted asset files are exposed; the vector is local (AV:L) with mandatory user interaction (UI:R), so there is no unattended or remotely reachable attack path and no privilege escalation beyond the logged-in user (S:U). Adobe self-reported the flaw in advisory APSB26-148 and rates it CVSS 3.1 7.8 HIGH; no public exploit code was identified at time of analysis and there is no KEV status confirming active exploitation.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search path (CWE-426): when a victim opens a crafted file, Bridge resolves and loads a library from a location an attacker can control, executing code under the victim's own account. The vendor's CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (8.2), while our independent assessment scores the same 8.2 band with PR:N and S:U, underscoring that the attack is strictly local, requires mandatory user interaction, and is bounded by the current user's privilege level rather than SYSTEM or root. Exploitation pressure is currently low: there is no public exploit identified at time of analysis, the issue is not in CISA KEV, CISA's SSVC decision framework rates Exploitation 'none' and Automatable 'no', and EPSS is only 0.15% (5th percentile).
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a crafted malicious file is opened. Affected versions include all releases up to 15.1.6 and 16.0.5. No active exploitation or public PoC has been identified at this time, and the vendor has issued a fix via APSB26-89.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a victim into opening a maliciously crafted file that triggers an untrusted pointer dereference (CWE-822). The flaw is local and file-based, requiring user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation yields full impact on confidentiality, integrity, and availability limited to the privileges of the user running Bridge.
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. The flaw is local and requires user interaction, carrying a CVSS 7.8 (High) score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) that executes attacker-controlled code in the context of the current user. The flaw affects Adobe Bridge as reported by Adobe (advisory APSB26-81) and is rated CVSS 7.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is local and hinges entirely on user interaction - the victim must open the malicious file.
Opening a specially crafted file in Adobe Bridge triggers an out-of-bounds read that leaks potentially sensitive contents of the application's process memory. The flaw is local in nature - an attacker must first deliver a malicious asset and convince a victim to open it in Bridge (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base score 5.5) - so there is no remote or server-side exposure and no authentication requirement. Impact is limited to information disclosure (confidentiality high, integrity and availability unaffected); no public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published advisory APSB26-148 covering the affected Bridge releases.
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Adobe rates the flaw 7.8 (HIGH) under CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local, client-side vector that requires user interaction rather than any network-facing or service exposure, with PR:N simply meaning no application authentication is needed while social engineering remains a prerequisite. No public exploit code or confirmed active exploitation was identified from the available intelligence at time of analysis, and the affected version range is unspecified in the source data, so any deployed Adobe Bridge build should be assumed potentially vulnerable until the vendor advisory is reconciled against the installed release.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution with the privileges of the user running Bridge (CVE-2026-75649, CVSS 7.8). The attack is local-host only and depends on user interaction - a victim must open an attacker-supplied malicious file - so it cannot be triggered remotely or automatically, and code executes in the current user's context with no privilege escalation (AV:L/PR:N/UI:R/S:U). At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, but because the advisory is vendor-published and the flaw is a memory-corruption RCE class, it should be treated as a genuine but conditional risk requiring social engineering to deliver.
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of the user who opens it (CVSS 7.8, CWE-121). The attack is local and requires user interaction - an attacker must deliver a malicious file and convince the victim to open it in Bridge (AV:L/AC:L/PR:N/UI:R/S:U), after which code runs in the current user's context without privilege escalation. Impact is limited by the strong social-engineering and delivery prerequisites, and no public exploit identified at time of analysis; risk is concentrated in users who routinely open files from untrusted or external sources.
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controlled code to run with the privileges of the current user. The issue is scored 7.8 (HIGH) and is a client-side, file-format-triggered flaw with a local attack vector and mandatory user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); the attacker does not authenticate to the product, but delivery depends entirely on social engineering the victim into opening the malicious file. Only unpatched Adobe Bridge versions addressed by vendor advisory APSB26-148 are affected, and no public exploit identified at time of analysis.
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning the attacker needs no prior privileges but must rely on social engineering to get the target to open a malicious file locally; successful exploitation yields full confidentiality, integrity, and availability impact within the user's own security context, with no privilege escalation to system level. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but non-urgent priority that should be handled through routine vendor patching; Adobe has published an advisory (APSB26-148) with fixed builds.
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing memory corruption that may lead to arbitrary code execution in the context of the current user. Only systems with Bridge installed where users routinely open untrusted asset files are exposed; the vector is local (AV:L) with mandatory user interaction (UI:R), so there is no unattended or remotely reachable attack path and no privilege escalation beyond the logged-in user (S:U). Adobe self-reported the flaw in advisory APSB26-148 and rates it CVSS 3.1 7.8 HIGH; no public exploit code was identified at time of analysis and there is no KEV status confirming active exploitation.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search path (CWE-426): when a victim opens a crafted file, Bridge resolves and loads a library from a location an attacker can control, executing code under the victim's own account. The vendor's CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (8.2), while our independent assessment scores the same 8.2 band with PR:N and S:U, underscoring that the attack is strictly local, requires mandatory user interaction, and is bounded by the current user's privilege level rather than SYSTEM or root. Exploitation pressure is currently low: there is no public exploit identified at time of analysis, the issue is not in CISA KEV, CISA's SSVC decision framework rates Exploitation 'none' and Automatable 'no', and EPSS is only 0.15% (5th percentile).
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a crafted malicious file is opened. Affected versions include all releases up to 15.1.6 and 16.0.5. No active exploitation or public PoC has been identified at this time, and the vendor has issued a fix via APSB26-89.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a victim into opening a maliciously crafted file that triggers an untrusted pointer dereference (CWE-822). The flaw is local and file-based, requiring user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation yields full impact on confidentiality, integrity, and availability limited to the privileges of the user running Bridge.
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. The flaw is local and requires user interaction, carrying a CVSS 7.8 (High) score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) that executes attacker-controlled code in the context of the current user. The flaw affects Adobe Bridge as reported by Adobe (advisory APSB26-81) and is rated CVSS 7.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is local and hinges entirely on user interaction - the victim must open the malicious file.
Opening a specially crafted file in Adobe Bridge triggers an out-of-bounds read that leaks potentially sensitive contents of the application's process memory. The flaw is local in nature - an attacker must first deliver a malicious asset and convince a victim to open it in Bridge (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base score 5.5) - so there is no remote or server-side exposure and no authentication requirement. Impact is limited to information disclosure (confidentiality high, integrity and availability unaffected); no public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published advisory APSB26-148 covering the affected Bridge releases.