The vulnerability is an out‑of‑bounds write in Adobe Bridge that allows a malformed file to corrupt memory during processing. If exploited, the crash can pivot to arbitrary code execution running with the current user’s privileges, a classic instance of CWE‑787. The flaw requires an attacker to supply a crafted file and for the victim to open it, so the attack vector hinges on user interaction and malicious file handling.

Adobe offers the affected product as Adobe Bridge. The CVE does not specify which exact releases are vulnerable, so any version of Bridge that has not received the patch disclosed in Adobe’s security advisory (APSb26‑89) should be considered at risk. System administrators should verify the installed Bridge version against Adobe’s published advisory and apply the update if it meets the vulnerability criteria.

The CVSS score of 7.8 indicates a high‑impact vulnerability with a good exploitation potential, yet the EPSS score of less than 1% suggests that, at the time of analysis, the likelihood of real‑world exploitation was low. Adobe has not listed this issue in the CISA KEV catalog, further implying that widespread attacks are not yet documented. Nevertheless, because the flaw can enable remote code execution once a user opens a malicious file, the risk is significant for environments where users have the ability to download or receive attachments from unknown or untrusted sources. The attack requires user interaction, but should a user open a crafted file, the compromise can occur immediately with no further access required.