Bridge is affected by an out-of-bounds read that could leak the contents of the process memory. An attacker who can deliver a crafted file to a target user can cause the vulnerable code to read beyond array boundaries, exposing sensitive data that resides in memory. The impacted material is not the Bridge files themselves, but arbitrary memory contents that may include passwords, certificates or other confidential information. This flaw falls under CWE-125 and results in an information-disclosure vulnerability.

Adobe Bridge is the affected product. The specific vulnerable version range is not disclosed in the advisory, but the flaw applies to any instance of Adobe Bridge that has not applied the vendor’s patch. Users who open a malicious file in Bridge could be impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown, but the flaw requires user interaction – the victim must open a malicious file. The vulnerability is not listed in the CISA KEV catalog, though it can lead to leakage of highly sensitive memory contents, posing a moderate to high confidentiality risk. Installing the vendor’s patch mitigates the risk significantly.