A flaw in Adobe Dimension’s handling of executable search paths allows a local attacker who has user permissions to execute arbitrary code in the context of the user’s account. The vulnerability requires the victim to run the application, and exploitation changes the security scope, enabling the attacker to run code with the same privileges as the victim.

Adobe Dimension installations are impacted. Because the CVE entry does not specify particular releases, all versions should be assumed vulnerable until a patch is released by Adobe.

The CVSS score of 8.6 signals a high severity vulnerability, yet the EPSS score of less than 1% indicates a low likelihood of real‑world exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is local: an attacker must be on the same machine and persuade the user to launch Dimension. Once the application is started, the attacker can run code with the victim’s privileges, which could lead to further compromise of local resources.