Adobe

An Untrusted Search Path vulnerability (CVE-2026-48395) in Adobe Bridge, affecting versions up to 16.0.5 and 15.1.6, can be exploited by an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file.

An out-of-bounds write vulnerability (CVE-2026-48393, CWE-787) in Adobe Bridge allows for arbitrary code execution in the context of the current user, requiring user interaction by opening a specially crafted malicious file.

A critical privilege escalation vulnerability, CVE-2026-48390, in Adobe Bridge allows an attacker to gain unauthorized read and write access if a victim opens a specially crafted malicious file, leading to potential system compromise.

A heap-based buffer overflow vulnerability, CVE-2026-48373, in Adobe Acrobat Reader could allow an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file.

An out-of-bounds write vulnerability (CVE-2026-48369) in Adobe Premiere Pro, requiring user interaction to open a malicious file, can lead to arbitrary code execution in the context of the current user.

CVE-2026-48342 is an Integer Overflow or Wraparound vulnerability in Adobe Bridge that could enable an attacker to achieve arbitrary code execution on a victim's system if the victim opens a specially crafted malicious file, affecting versions up to 16.0.3 and 15.1.5.

An Uncontrolled Search Path Element vulnerability (CVE-2026-48272) in Adobe Creative Cloud Desktop versions up to 6.9.1.1 could allow arbitrary code execution in the context of the current user, requiring no user interaction but dependent on conditions beyond the attacker's full control.

A critical stack-based buffer overflow vulnerability, CVE-2026-47971, in Adobe Media Encoder versions prior to 26.3 and 25.6.6 could lead to arbitrary code execution within the context of the current user when a victim opens a specially crafted malicious file.

Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability, tracked as CVE-2009-3459, that could allow remote attackers to execute arbitrary code via a crafted PDF file.

A local attacker can exploit multiple vulnerabilities in Adobe Creative Cloud applications to execute arbitrary program code, disclose confidential information, or cause a denial-of-service condition.

Adobe Substance3D Designer versions 15.1.0 and earlier are susceptible to an out-of-bounds write vulnerability (CVE-2026-34682) that can lead to arbitrary code execution if a user opens a specially crafted malicious file.

Adobe Illustrator versions 29.8.6, 30.3 and earlier are affected by a heap-based buffer overflow vulnerability (CVE-2026-34687) that can lead to arbitrary code execution if a user opens a malicious file.

Adobe Substance3D Painter versions 12.0.2 and earlier are vulnerable to an out-of-bounds write, potentially leading to arbitrary code execution if a user opens a malicious file.

Adobe Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability (CVE-2026-34637) that could lead to arbitrary code execution if a user opens a malicious file.

Adobe Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability (CVE-2026-34636) that could lead to arbitrary code execution when a user opens a malicious file.

Adobe patched CVE-2026-34621, a zero-day vulnerability in Acrobat and Reader exploited since December, allowing malicious PDFs to bypass sandboxes and execute arbitrary code, potentially leading to local file theft.

This brief outlines a potential persistence mechanism involving hijacking Adobe-related processes or components, which could allow attackers to maintain unauthorized access to a system.

Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier are susceptible to a use-after-free vulnerability (CVE-2026-27283), potentially leading to arbitrary code execution if a user opens a specially crafted file.

Attackers can maintain persistence by replacing the legitimate RdrCEF.exe file, used by Adobe Acrobat Reader, with a malicious executable that will be launched upon execution of Adobe Acrobat Reader.