Adobe Bridge, Format Plugins get RCE patches
Adobe patched multiple code-execution vulnerabilities in Bridge and Format Plugins; no in-the-wild exploitation reported.
Adobe has disclosed multiple vulnerabilities affecting Adobe Bridge and Adobe Format Plugins that could lead to arbitrary code execution in the context of the logged-on user. The flaws include untrusted search path issues, incorrect authorization, path traversal, out-of-bounds write conditions, and a heap-based buffer overflow, spanning Adobe Bridge versions 15.1.6 (LTS) and earlier, 16.0.5 and earlier, and Adobe Format Plugins 2026.05 and earlier.
Exploitation would allow an attacker to execute code with the privileges of the logged-in user, potentially enabling installation of programs, data manipulation, or creation of new accounts, with impact scaled to the user's privilege level. MS-ISAC notes there are currently no reports of these vulnerabilities being exploited in the wild. Organizations are advised to apply Adobe's stable channel updates after testing and to implement standard mitigations such as least privilege, application allowlisting, and exploit protection features.
Mentioned in this report
Detection guidance
Adobe Bridge or Format Plugins Spawning Unusual Child Process
Detects Adobe Bridge or Format Plugin host processes spawning shells or scripting interpreters, consistent with post-exploitation code execution following an RCE in Adobe Bridge/Format Plugins. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Bridge or Format Plugins Spawning Unusual Child Process
description: Adobe Bridge and its Format Plugins normally do not spawn command shells,
scripting engines, or LOLBins. Such a child process shortly after Bridge/Format
Plugin activity is consistent with exploitation of a client-execution vulnerability
(untrusted search path, path traversal, OOB write, heap overflow) leading to arbitrary
code execution in the user's context.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Bridge.exe
- \FormatPlugins.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
filter_updater:
CommandLine|contains:
- AdobeUpdater
- AdobeARM
condition: selection and not filter_updater
falsepositives:
- Adobe update or repair routines that legitimately invoke helper scripts or rundll32
- Third-party Bridge extensions that shell out to command-line tools
level: medium
id: b510a5f2-12a0-53ad-8243-9413c1d9bc64
status: experimental
author: Vorant
Adobe Bridge Loading DLL From Non-Standard Writable Path
Detects Adobe Bridge loading a DLL from a user-writable or non-installation directory, indicative of exploitation of an untrusted search path vulnerability enabling DLL side-loading. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Bridge Loading DLL From Non-Standard Writable Path
description: Adobe Bridge is affected by an untrusted search path vulnerability that
can allow a malicious DLL placed in an attacker-controlled or user-writable directory
to be loaded instead of the legitimate library. This rule looks for Bridge.exe loading
modules from locations outside its normal Program Files installation path, such
as Temp, Downloads, AppData, or removable/network drives.
tags:
- attack.execution
- attack.t1203
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \Bridge.exe
ImageLoaded|endswith: .dll
suspicious_path:
ImageLoaded|contains:
- \AppData\Local\Temp
- \Downloads\
- \Users\Public\
- \ProgramData\
filter_legit:
ImageLoaded|contains:
- \Program Files\Adobe\
- \Program Files (x86)\Adobe\
- \Windows\System32\
- \Windows\SysWOW64\
condition: selection and suspicious_path and not filter_legit
falsepositives:
- Bridge extensions or third-party plugins installed under user profile paths
- Portable/test installations of Adobe Bridge running from Temp or Downloads
level: medium
id: 5b01dbcf-7552-5f0d-9fa2-a599f36eee51
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-073
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free