CVE-2026-21347
Published: 10 February 2026
Summary
CVE-2026-21347 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Adobe Bridge. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 10.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-21347 is an Integer Overflow or Wraparound vulnerability (CWE-190) affecting Adobe Bridge versions 15.1.3, 16.0.1, and earlier. This flaw could lead to arbitrary code execution in the context of the current user when a victim opens a malicious file, requiring user interaction for exploitation.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating local access with low complexity, no privileges required, and user interaction needed. An attacker can exploit it by crafting a malicious file and tricking a user into opening it within Bridge, achieving high-impact arbitrary code execution with full confidentiality, integrity, and availability compromise under the user's privileges.
Adobe's security advisory at https://helpx.adobe.com/security/products/bridge/apsb26-21.html provides details on the issue, published on 2026-02-10, and outlines mitigation steps including applying the available patches to update to unaffected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6384
Vulnerability details
Bridge versions 15.1.3, 16.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in client-side Adobe Bridge enables RCE via crafted malicious file opened by user (direct match to User Execution: Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the integer overflow vulnerability in Adobe Bridge by requiring identification, reporting, and timely patching as provided in the vendor advisory.
Enables periodic and event-driven vulnerability scanning to identify systems running vulnerable versions of Adobe Bridge affected by CVE-2026-21347.
Deploys malicious code protection mechanisms to scan and block malicious files crafted to exploit the integer overflow prior to opening in Bridge.