An improper input validation flaw in Adobe Dreamweaver Desktop allows an attacker to craft a malicious file that, when opened by a user, causes the application to execute arbitrary code in the context of that user. The vulnerability is triggered by user interaction—specifically, the victim must open a specially crafted file—resulting in the local compromise of the affected system.

Adobe Dreamweaver Desktop versions 21.6 and earlier are vulnerable. The flaw exists on any hardware platform running the supported operating systems, including macOS and Windows, as the software bundle is cross‑platform.

The flaw carries a CVSS score of 8.6, indicating high severity. EPSS is reported as below 1%, suggesting a currently low exploitation probability; it is not listed in CISA’s KEV catalog. Because an attacker must deliver a malicious file to the target user, the attack vector is local/user interaction. Successful exploitation would enable the attacker to execute arbitrary code with the privileges of the victim user, potentially leading to system compromise.