Back to overview

CVE-2026-48391

HIGH
8.2
CVSS 3.1
Description
Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Metadata

CVE ID
CVE-2026-48391
State
PUBLISHED
Assigner
adobe
Reserved
2026-05-21 15:28 UTC
Published
2026-07-28 17:58 UTC
Last updated
2026-07-29 03:56 UTC
Primary CWE
CWE-426
Untrusted Search Path (CWE-426)
Vendor / Product
Adobe / Adobe Bridge
Sources
cve.org  ·  NVD

Severity & Metrics

8.2 HIGH CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (2)
VendorProductPlatformVersions
Adobe Adobe Bridge — 0 ≤ 16.0.5, 16.0.6
Adobe Adobe Bridge — 0 ≤ 15.1.6, 15.1.7
Weakness (CWE)
CWESourceDescription
CWE-426 cna Untrusted Search Path (CWE-426)
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.2 HIGH 3.1 cna CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
References (1)
Back to overview