A heap-based buffer overflow in Adobe Bridge allows an attacker to execute arbitrary code as the victim when a malicious file is opened. The flaw arises from improper bounds checking during processing of a file, leading to a buffer overflow on the heap. When exploited, the attacker can run arbitrary code with the privileges of the user opening the file, potentially compromising data confidentiality, integrity, and availability.

Adobe Bridge versions 16.0.2, 15.1.4 and all earlier releases are vulnerable. End users running these versions of Bridge on any supported platform are at risk if a malicious file is opened.

The vulnerability is rated high with a CVSS score of 7.8. No EPSS score is available and the issue is not listed in CISA’s KEV catalog, indicating no public exploit is presently known. The likely attack vector requires a victim to open a malicious file, meaning an attacker needs user interaction to deliver the exploit payload. Once the file is opened, the buffer overflow allows arbitrary code execution with the user’s privileges.