CVE-2025-54278
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Adobe Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this to disclose sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.
Risk Assessment
The organization may suffer sensitive data leakage from memory, potentially leading to confidentiality breaches.
Recommendation
It is recommended to update Adobe Bridge to the latest patched version and educate users to open only trusted files.
Other vulnerabilities in Adobe Bridge
See all- CVE-2026-48311High
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.
- CVE-2026-34630High
Heap-based Buffer Overflow vulnerability in Bridge versions 16.0.2, 15.1.4 and earlier. Could result in arbitrary code execution in the context of the current user. Requires user interaction to open a malicious file.
- CVE-2026-27310High
Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file.
- CVE-2026-21283High
Bridge versions 15.1.2, 16.0 and earlier are affected by a heap-based buffer overflow that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.
Original NVD description (English source)
Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS