Adobe Bridge is vulnerable to an incorrect authorization flaw that can lead to privilege escalation. The flaw allows an attacker to gain unauthorized read and write access to files after the user opens a malicious file. This grants the attacker the ability to read or modify sensitive data within the application’s scope, thereby compromising confidentiality and integrity of resources. The weakness is classified as CWE‑863.

Adversaries may target Adobe Bridge installations on any platform where the application is installed. Specific affected versions are not listed in the advisory, so assuming all current releases prior to the vendor’s patch are vulnerable.

The vulnerability has a CVSS score of 8.2, indicating high severity, but its EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires the victim to open a malicious file, so user interaction is mandatory. Attackers must first craft or obtain a file that, when opened by Bridge, triggers the incorrect authorization and then perform unauthorized read or write operations within the application. Given the user interaction requirement and low exploit probability, the immediate risk is moderate, but the potential impact warrants timely remediation.