Description
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability in Adobe Bridge allows an out‑of‑bounds write when processing a malicious file, which can lead to arbitrary code execution in the context of the user opening the file. The flaw arises from an insufficient bounds check in the file parsing routine, enabling memory corruption that may be crafted to execute attacker‑supplied code.

Affected Systems

Adobe Bridge users on any version that does not yet contain the security fix may be affected. The CNA lists no specific version numbers, so the vulnerability may exist in all actively supported Bridge editions until patched.

Risk and Exploitability

The vulnerability requires a user to open a malicious file to trigger exploitation. It can lead to arbitrary code execution in the context of the current user. The CVSS score of 7.8 indicates a high severity, and the EPSS score of < 1% suggests a very low likelihood of exploitation. It is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 16, 2026 at 03:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Adobe Bridge update that contains the security fix; see Adobe’s security advisory for the specific patch package.
  • Avoid opening files from untrusted or unknown sources in Bridge; consider disabling file preview or auto‑open features in the application preferences.
  • Ensure that files processed by Bridge are scanned with up‑to‑date antivirus or sandboxed in a restricted environment to prevent accidental execution of malicious content.
  • If an immediate patch is not available, restrict the file types that Bridge can read from external locations or source control to mitigate exploitation risk.

Generated by OpenCVE AI on October 16, 2026 at 03:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Bridge
Vendors & Products Adobe
Adobe adobe Bridge

Wed, 14 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Bridge | Out-of-bounds Write (CWE-787)
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Adobe Bridge
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T10:40:49.815Z

Reserved: 2026-09-25T11:21:55.100Z

Link: CVE-2026-100128

cve-icon Vulnrichment

Updated: 2026-10-14T10:39:07.674Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T21:17:14.870

Modified: 2026-10-14T15:50:50.180

Link: CVE-2026-100128

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T20:45:16Z

Weaknesses