Adobe Dreamweaver Desktop versions 21.6 and earlier contain an input validation vulnerability that could lead to arbitrary code execution upon the opening of a specially crafted file.

This vulnerability is caused by improper input validation (CWE-20) which allows an attacker to achieve arbitrary code execution. The attack vector is local, requiring user interaction as a victim must open a malicious file for the exploit to trigger.

The potential for arbitrary code execution poses a significant threat to organizational security, as it could allow an attacker to gain full control over the workstation of the affected user. With a CVSS score of 8.6, this vulnerability is classified as High severity, indicating that successful exploitation could lead to total compromise of confidentiality, integrity, and availability within the local user context.

Immediate Action: Update Adobe Dreamweaver Desktop to version 21.7 or later to implement the vendor provided fix.

Proactive Monitoring: Monitor endpoint activity for unauthorized child processes spawned by the Dreamweaver application and review file access logs for suspicious file interactions.

Compensating Controls: Deploy endpoint detection and response (EDR) solutions to identify and block malicious file execution attempts, and enforce strict policies against opening untrusted files.

Public Exploit Available: exploit_available (false)

Given the High severity of this vulnerability, immediate patching is essential to prevent potential system compromise. Organizations should identify all installations of Adobe Dreamweaver Desktop within their environment and update them to version 21.7 immediately to eliminate the risk of arbitrary code execution.