Bridge is vulnerable to a heap‑based buffer overflow that allows an attacker to inject code and execute it with the current user’s privileges. The flaw arises when the program processes a maliciously crafted file. Successful exploitation would lead to arbitrary code execution, compromising the confidentiality, integrity, and availability of the victim’s system. The weakness is a classic out‑of‑bounds write (CWE‑122).

Adobe Bridge on all affected releases, installers from Adobe:Adobe Bridge, Adobe:Adobe Bridge. No specific versions are listed, so any released version that has not yet applied the patch could be at risk.

The CVSS score of 7.8 indicates a high severity, and the exploit requires a victim to open a crafted file, implying that social engineering is needed for exploitation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation at the time of analysis. Exploitability depends on user interaction—untrusted files could be distributed via email, download or malicious websites, and if the victim opens them in Bridge, execution can occur. The attack path is local, requiring only file‑opening privileges, so widespread compromise would need mass delivery or further escalation. Therefore the risk remains significant, especially in environments where Bridge is accessible to many users.