Adobe Bridge
Monthly
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed." CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, score 8.2. CWE-426: Untrusted Search Path. Tags: RCE, Adobe Bridge. SSVC: exploitation none, automatable no, technical impact total. Patch: there is no explicit patch data in the input, but references point to Adobe advisory: https://helpx.adobe.com/security/products/bridge/apsb26-89.html. The version ranges affected: "Adobe Bridge 0 ≤16.0.5" and "Adobe Bridge 0 ≤15.1.6" (probably meaning versions up to but not including? The EUVD says "Adobe Bridge 0 ≤16.0.5" and "0 ≤15.1.6" which is ambiguous — likely affected versions up to, but not including? Actually, it says "0 ≤16.0.5" which might indicate versions from 0 up to 16.0.5, so 16.0.5 is affected. But typical phrasing "versions up to and including 16.0.5". The advisory APSB26-89 might have more details. We'll note that affected products are Adobe Bridge versions up to 16.0.5 and 15.1.6, and presumably patch versions are later: 16.0.6 and 15.1.7? But the advisory isn't fully spelled out in input. We'll extract from the EUVD data: "Adobe Bridge 0 \u226416.0.5" means "Adobe Bridge 0 ≤16.0.5". So version 16.0.5 and earlier are affected. The referenced advisory likely states patched version 16.0.6. So remediation: update to version 16.0.6 (or 15.1.7 for 15.x branch). We'll incorporate that. We have no KEV status, so no active exploitation confirmed. No POC mentioned, but no explicit statement, so we'll say no public exploit identified. SSVC exploitation none, automatable no, so not easily automated. EPSS not provided, bu
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a crafted malicious file is opened. Affected versions include all releases up to 15.1.6 and 16.0.5. No active exploitation or public PoC has been identified at this time, and the vendor has issued a fix via APSB26-89.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a victim into opening a maliciously crafted file that triggers an untrusted pointer dereference (CWE-822). The flaw is local and file-based, requiring user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation yields full impact on confidentiality, integrity, and availability limited to the privileges of the user running Bridge.
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. The flaw is local and requires user interaction, carrying a CVSS 7.8 (High) score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) that executes attacker-controlled code in the context of the current user. The flaw affects Adobe Bridge as reported by Adobe (advisory APSB26-81) and is rated CVSS 7.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is local and hinges entirely on user interaction - the victim must open the malicious file.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed." CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, score 8.2. CWE-426: Untrusted Search Path. Tags: RCE, Adobe Bridge. SSVC: exploitation none, automatable no, technical impact total. Patch: there is no explicit patch data in the input, but references point to Adobe advisory: https://helpx.adobe.com/security/products/bridge/apsb26-89.html. The version ranges affected: "Adobe Bridge 0 ≤16.0.5" and "Adobe Bridge 0 ≤15.1.6" (probably meaning versions up to but not including? The EUVD says "Adobe Bridge 0 ≤16.0.5" and "0 ≤15.1.6" which is ambiguous — likely affected versions up to, but not including? Actually, it says "0 ≤16.0.5" which might indicate versions from 0 up to 16.0.5, so 16.0.5 is affected. But typical phrasing "versions up to and including 16.0.5". The advisory APSB26-89 might have more details. We'll note that affected products are Adobe Bridge versions up to 16.0.5 and 15.1.6, and presumably patch versions are later: 16.0.6 and 15.1.7? But the advisory isn't fully spelled out in input. We'll extract from the EUVD data: "Adobe Bridge 0 \u226416.0.5" means "Adobe Bridge 0 ≤16.0.5". So version 16.0.5 and earlier are affected. The referenced advisory likely states patched version 16.0.6. So remediation: update to version 16.0.6 (or 15.1.7 for 15.x branch). We'll incorporate that. We have no KEV status, so no active exploitation confirmed. No POC mentioned, but no explicit statement, so we'll say no public exploit identified. SSVC exploitation none, automatable no, so not easily automated. EPSS not provided, bu
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a crafted malicious file is opened. Affected versions include all releases up to 15.1.6 and 16.0.5. No active exploitation or public PoC has been identified at this time, and the vendor has issued a fix via APSB26-89.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a victim into opening a maliciously crafted file that triggers an untrusted pointer dereference (CWE-822). The flaw is local and file-based, requiring user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation yields full impact on confidentiality, integrity, and availability limited to the privileges of the user running Bridge.
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. The flaw is local and requires user interaction, carrying a CVSS 7.8 (High) score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) that executes attacker-controlled code in the context of the current user. The flaw affects Adobe Bridge as reported by Adobe (advisory APSB26-81) and is rated CVSS 7.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is local and hinges entirely on user interaction - the victim must open the malicious file.