Adobe Bridge has an Untrusted Search Path flaw that allows an attacker to run arbitrary code in the context of the current user. By supplying a specially crafted file, a low‑privileged user who opens that file can cause Bridge to load a malicious executable from an untrusted directory. The vulnerability can trigger local code execution and, because scope is changed, may lead to elevation of privileges within the user’s session.

Adobe Bridge from Adobe Inc. The advisory did not list specific version numbers; any installation of Bridge is potentially affected.

The flaw carries a CVSS score of 8.2, reflecting a high severity attack with full user‑level privilege. Its EPSS score is below 1 percent, meaning real‑world exploitation is currently unlikely but cannot be dismissed. The vulnerability is not found in the CISA KEV list. It requires that a victim open a malicious file, so the vector is user‑interaction, or “click‑through.” If an attacker can co‑ordinate this action, the code will execute with the victim’s rights, potentially leading to data theft or further lateral movement.