Bridge suffers an out-of-bounds write that allows an attacker to write data beyond the bounds of a memory buffer, enabling the execution of arbitrary code in the context of the current user. The impact is the loss of confidentiality, integrity, and availability for the user session, as the attacker could run any code the user is authorized to execute. This weakness corresponds to CWE‑787, which covers out‑of‑bounds writes.

The vulnerability affects Adobe Bridge products released by Adobe Inc. The specific affected versions are not listed in the advisory, so all current releases prior to the published patch should be treated as vulnerable until verified otherwise.

The CVSS score of 7.8 categorizes the flaw as high severity. The EPSS score is less than 1 %, indicating a very low probability of exploitation in the wild, though the failure requires user interaction to open a malicious file. The typical attack vector involves tricking a user into opening a maliciously crafted file with Adobe Bridge, which triggers the out-of-bounds write and leads to arbitrary code execution. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. Nonetheless, the potential to run arbitrary code remains significant, so organizations should treat it as a high‑risk issue pending a vendor fix.