A heap‑based buffer overflow in Adobe Bridge versions 16.0.2, 15.1.4 and earlier can be triggered by a malicious file, allowing an attacker to execute code in the context of the user who opens the file. The vulnerability arises from improper bounds checking when handling certain data structures in memory, leading to arbitrary code execution.

Adobe Bridge software produced by Adobe, affecting all releases up to and including Bridge 16.0.2 and 15.1.4, as well as earlier editions.

The CVSS score of 7.8 classifies this issue as high severity. While no EPSS score is published, the requirement for the victim to open a malicious file means the exploitation path is user‑interaction based, making it less likely to be automated but still a significant risk if users are lured to execute files. The vulnerability is not listed in the CISA KEV catalog, but the possibility of arbitrary code execution warrants urgency.