Dreamweaver Desktop versions 21.7 and earlier contain a dependency on a vulnerable third‑party component that permits arbitrary code execution in the context of the current user. The flaw changes the scope of the affected components, meaning code can execute with the privileges of the AE application, potentially affecting system resources. An attacker can exploit the issue only when a victim opens a crafted file, as user interaction is required for delivery.

Adobe Dreamweaver Desktop components bundled in versions 21.7 and earlier are impacted. All newer releases that incorporate a non‑vulnerable component are not affected.

The CVSS score of 8.6 indicates high severity, and the EPSS score of < 1% indicates a very low but non-zero exploitation probability. The vulnerability is not listed in CISA KEV, so no known active exploitation is reported. The attack vector is local user interaction – a malicious file must be opened within Dreamweaver to trigger the flaw, making the risk significant for users who routinely handle unknown documents.