CVE-2026-27313

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27313", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-02-18T22:02:41.402Z", "datePublished": "2026-04-14T19:44:55.987Z", "dateUpdated": "2026-08-27T22:15:40.097Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Bridge", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "16.0.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "16.0.3", "versionType": "semver"}, {"lessThanOrEqual": "15.1.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "15.1.5", "versionType": "semver"}]}], "datePublic": "2026-04-14T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "Heap-based Buffer Overflow (CWE-122)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:15:40.097Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/bridge/apsb26-39.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Bridge | Heap-based Buffer Overflow (CWE-122)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27313", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T03:58:51.017959Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T09:13:11.961Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27313", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T03:58:51.017959Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T09:07:37.357Z"}}], "cna": {"title": "Bridge | Heap-based Buffer Overflow (CWE-122)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modifiedScope": "UNCHANGED", "temporalScore": 7.8, "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "HIGH", "environmentalScore": 7.8, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Bridge", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "16.0.2"}, {"status": "unaffected", "version": "16.0.3", "versionType": "semver"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "15.1.4"}, {"status": "unaffected", "version": "15.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-14T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/bridge/apsb26-39.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "Heap-based Buffer Overflow (CWE-122)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:15:40.097Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27313", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:15:40.097Z", "dateReserved": "2026-02-18T22:02:41.402Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-04-14T19:44:55.987Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Bridge", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "16.0.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "16.0.3", "versionType": "semver"}, {"lessThanOrEqual": "15.1.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "15.1.5", "versionType": "semver"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:bridge:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B4FBE0D-49AE-47B0-9A02-CF772B606C89", "versionEndExcluding": "15.1.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:bridge:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA94FD4C-CD52-43BC-9DD6-C688A783A5F9", "versionEndExcluding": "16.0.3", "versionStartIncluding": "16.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Las versiones 16.0.2, 15.1.4 y anteriores de Bridge est\u00e1n afectadas por una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo que podr\u00eda resultar en la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, en el sentido de que la v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-27313", "lastModified": "2026-08-28T00:17:15.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27313", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T03:58:51.017959Z", "version": "2.0.3"}}]}, "published": "2026-04-14T20:16:34.883", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/bridge/apsb26-39.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,15.1.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Bridge", "source": "cna", "vendor": "Adobe"}, "product": "bridge", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-14T21:15:27.616351+00:00", "value": {"mitigation_remediation": ["Apply the latest Adobe Bridge update from Adobe\u2019s official website; the current patch removes the heap\u2011based buffer overflow.", "Avoid opening unknown or suspicious files in Adobe Bridge; treat any file that appears untrusted as potentially malicious.", "When possible, restrict the file types that Bridge can open or run Bridge in a sandboxed environment to isolate execution.", "Keep the operating system and all related Adobe applications updated to the latest security releases.", "Monitor Adobe security advisories for further updates or additional mitigations."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary code execution"}, "threat_synthesis": {"affected_systems": "Adobe Bridge releases 16.0.2, 15.1.4 and all earlier versions are affected. The issue can be triggered on any platform where these versions run by opening a malicious file.", "description_and_impact": "Adobe Bridge contains a heap\u2011based buffer overflow that allows an attacker to write beyond a buffer boundary when processing a specially crafted file. The flaw can lead to arbitrary code execution in the context of the user running Bridge, representing a significant compromise of confidentiality, integrity, and availability. This is a memory corruption vulnerability classified as CWE\u2011122.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.8, indicating high severity. Exploitation requires a victim to open a malicious file, so user interaction is mandatory. No EPSS score is available, and the flaw is not listed in CISA\u2019s KEV catalog, suggesting no publicly known exploits yet. Nevertheless, the combination of high severity and a user\u2011interaction attack vector makes this a critical risk for environments where users handle untrusted files."}}}}, "created": "2026-04-15T14:31:56.905483+00:00", "updated": "2026-04-15T14:41:09.773859+00:00", "vendors": ["adobe", "adobe$PRODUCT$bridge"]}