CVE-2026-100128: Out-of-bounds Write (CWE-787) in Adobe Adobe Bridge

CVE-2026-100128 is an out-of-bounds write vulnerability in Adobe Bridge that can lead to arbitrary code execution in the context of the current user. The vulnerability requires user interaction, meaning the victim must open a crafted malicious file to trigger the flaw. The vulnerability affects Adobe Bridge versions up to and including 16.0.7 and 15.1.8. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. However, exploitation requires the victim to open a malicious file, which limits the attack vector to scenarios involving user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Adobe's security advisories for updates. Until a patch is available, users should avoid opening untrusted files in Adobe Bridge.