Description
Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-01-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary Code Execution
Action: Patch Now
AI Analysis

Impact

Bridge versions 15.1.2, 16.0 and earlier are affected by a heap-based buffer overflow that can lead to arbitrary code execution in the context of the current user. The flaw arises when a specially crafted file is processed, allowing the attacker to overwrite heap memory and execute arbitrary code.

Affected Systems

Affected versions of Adobe Bridge include 15.1.2, 16.0, and all earlier releases for both Windows and macOS operating systems.

Risk and Exploitability

The flaw carries a CVSS score of 7.8, indicating high severity, but the EPSS score is below 1%, implying low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction, namely opening a malicious file, so attack vector is local. Successful exploitation would allow attackers to run code with the victim’s privileges.

Generated by OpenCVE AI on April 18, 2026 at 16:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Adobe Bridge security update that fixes the heap-based buffer overflow
  • Avoid opening files from untrusted sources until the patch is applied
  • Provide user training to recognize potentially malicious files and enforce a file quarantine policy if possible

Generated by OpenCVE AI on April 18, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Jan 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Microsoft
Microsoft windows
Weaknesses CWE-787
CPEs cpe:2.3:a:adobe:bridge:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:bridge:16.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Microsoft
Microsoft windows

Wed, 14 Jan 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe bridge
Vendors & Products Adobe
Adobe bridge

Tue, 13 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Jan 2026 19:00:00 +0000

Type Values Removed Values Added
Description Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Bridge | Heap-based Buffer Overflow (CWE-122)
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Bridge
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-02-26T15:04:14.303Z

Reserved: 2025-12-12T22:01:18.189Z

Link: CVE-2026-21283

cve-icon Vulnrichment

Updated: 2026-01-13T19:08:18.970Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-13T19:16:26.013

Modified: 2026-01-14T19:28:34.103

Link: CVE-2026-21283

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T16:30:05Z

Weaknesses