Adobe Dimension is vulnerable to an out-of-bounds write that can be exploited to execute arbitrary code in the user’s context. The flaw can be triggered by processing a specially crafted file and does not require network access or additional privileges. Because the attacker must supply a malicious file, the attack requires user interaction rather than remote exploitation.

Any Adobe Dimension installation is potentially impacted; the vendor has not released explicit version ranges, so all variants should be treated as at risk until a patch is applied.

The CVSS score of 7.8 reflects a high severity impact, yet the EPSS score is <1% and the flaw is not listed in the CISA KEV catalog. The need for the victim to open a malicious file reduces the likelihood of widespread exploitation, but the ability to execute code in the user’s context remains a significant risk for systems that handle untrusted documents.