Dreamweaver Desktop versions 21.6 and earlier contain an improper input validation flaw whose exploitation can result in arbitrary code execution in the context of the user who opens a malicious file. The flaw arises when Dreamweaver processes a crafted file and does not adequately check the input before executing script or code embedded within that file. Attackers can inject malicious payloads that run with the privileges of the user, potentially compromising the system and any data accessed by that user.

Adobe's Dreamweaver Desktop, across Windows and macOS platforms, is affected. The vulnerability applies to all installations running version 21.6 or older, regardless of operating system. Additional systems that use the application for development or publishing work may also be impacted if they load untrusted content into the editor.

The CVSS score of 8.6 indicates a high severity, while the EPSS score of less than 1% suggests that, so far, exploitation attempts are rare. However, the vulnerability is listed as not in the KEV catalog, meaning no known widespread attacks have been reported yet. Exploitation requires user interaction: a victim must open a malicious Dreamweaver file, so foreknowledge and precautions around file handling can mitigate risk. In environments where users routinely open third‑party files, the risk is elevated.