The vulnerability is a heap‑based buffer overflow (CWE‑122) and an out‑of‑bounds write (CWE‑787) in Adobe’s Format Plugins that can lead to arbitrary code execution within the context of the current user. The flaw arises when the plugin processes certain file types without proper bounds checking, allowing an attacker to overflow a heap buffer and execute attacker‑controlled code. Successful exploitation could compromise the session of the victim, granting the attacker full control with the user's privileges.

Adobe Format Plugins. The advisory does not specify affected versions, so administrators should check all existing installations and apply the latest Adobe release that addresses this flaw.

The CVSS score is 7.8, reflecting a high severity vulnerability, while the EPSS score is below 1 %, suggesting a low likelihood of immediate broad exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires user interaction—specifically, a victim must open a malicious file containing the crafted payload. Although the need for user action lowers the overall risk to organizations, the potential for arbitrary code execution remains a serious threat if users are deceived into opening suspicious documents.