A high-severity flaw in Adobe Bridge allows for local arbitrary code execution due to an untrusted search path vulnerability.

This is an untrusted search path vulnerability (CWE-426) that allows an attacker to manipulate the file path search process. The vulnerability requires user interaction and can be triggered by a local attacker to achieve code execution with the privileges of the active user.

Successful exploitation could result in a full compromise of the user account running Adobe Bridge, potentially leading to data exfiltration, lateral movement, or unauthorized installation of malicious software. While the CVSS score of 8.6 reflects a high severity, the requirement for local access and user interaction limits the immediate scope compared to remote attacks.

Immediate Action: Update Adobe Bridge to version 16.0.6 or 15.1.7 immediately to resolve the vulnerable search path logic.

Proactive Monitoring: Monitor endpoint processes for unusual child processes spawned by Adobe Bridge or unexpected library loading behavior.

Compensating Controls: Ensure users operate with the principle of least privilege to minimize the impact if code execution is achieved.

Public Exploit Available: Unknown

Given the high impact of arbitrary code execution, organizations should prioritize the deployment of the vendor-provided patches. Administrators must ensure all instances of Adobe Bridge are updated to the specified secure versions to mitigate this risk.