CVE-2026-75655: Bridge Uncontrolled Recursion RCE Vulnerability

CVE-2026-75655 Overview

CVE-2026-75655 is an uncontrolled recursion vulnerability [CWE-674] in Adobe Bridge that can lead to arbitrary code execution in the context of the current user. An attacker crafts a malicious file that, when opened by a victim, triggers unbounded recursive calls within the application. The recursion path leads to stack corruption or exhaustion that Adobe describes as exploitable for code execution.

Adobe published the fix in security advisory APSB26-148. Exploitation requires user interaction because the victim must open the malicious file. The attack vector is local, and no public exploit or in-the-wild activity has been reported at the time of publication.

Critical Impact
Successful exploitation grants the attacker code execution with the privileges of the user running Adobe Bridge, enabling data theft, persistence, or lateral movement from the compromised endpoint.

Affected Products

Adobe Bridge (versions listed in Adobe advisory APSB26-148)
Windows installations of Adobe Bridge
macOS installations of Adobe Bridge

Discovery Timeline

2026-09-22 - CVE-2026-75655 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-75655

Vulnerability Analysis

Adobe Bridge parses a wide range of media and metadata formats. CVE-2026-75655 stems from a parsing path that recurses without an effective termination condition when it processes attacker-controlled structures. The uncontrolled recursion [CWE-674] consumes stack frames until it corrupts adjacent memory or reaches a controllable state.

According to the Adobe advisory, the resulting condition is not a simple denial of service. The recursion produces a state that permits arbitrary code execution in the process context of Adobe Bridge. Because Bridge runs as the interactive user, the executed code inherits that user's file access, network permissions, and cached credentials.

The vulnerability requires local access and user interaction. An attacker must deliver a malicious file (through phishing, a shared drive, or a web download) and convince the user to open it in Bridge.

Root Cause

The root cause is a recursive parsing routine that lacks a hard depth limit or cycle detection. Malformed nesting in the input file drives the routine beyond safe bounds. Adobe has not published the affected function names or file format details.

Attack Vector

The attack begins with a crafted document opened in Adobe Bridge. Parsing the malicious structure invokes the recursive routine repeatedly. The resulting memory state is manipulated by the attacker's payload to redirect execution flow. Full technical details are available in the Adobe Security Advisory APSB26-148.

Detection Methods for CVE-2026-75655

Indicators of Compromise

Unexpected child processes (for example, cmd.exe, powershell.exe, or shell interpreters) spawned by the Bridge.exe process on Windows or the Bridge helper on macOS.
Adobe Bridge crash dumps referencing stack overflow or deep call stacks in file-parsing modules.
Newly created persistence artifacts (scheduled tasks, Run keys, LaunchAgents) created shortly after a user opened a file in Bridge.

Detection Strategies

Hunt for process lineage where Adobe Bridge is the parent of scripting or living-off-the-land binaries such as wscript.exe, mshta.exe, or rundll32.exe.
Correlate Bridge application crash events with subsequent outbound network connections from the same user session.
Baseline the file types users typically open in Bridge and alert on outliers delivered by email or downloaded from untrusted domains.

Monitoring Recommendations

Enable EDR telemetry for module loads and process creation events under Bridge.exe and its helper processes.
Forward Adobe Bridge Windows Error Reporting and macOS crash logs to a central log store for retrospective analysis.
Monitor file-write activity in user profile directories that follows a Bridge session, especially executable or script file creation.

How to Mitigate CVE-2026-75655

Immediate Actions Required

Apply the fixed Adobe Bridge version listed in Adobe Security Advisory APSB26-148 on all affected endpoints.
Instruct users to avoid opening Bridge files received from untrusted sources until patching is complete.
Inventory endpoints running Adobe Bridge and prioritize patch deployment on workstations used by high-value users such as designers, executives, and administrators.

Patch Information

Adobe released the patch through security bulletin APSB26-148. Administrators should deploy the updated Bridge build using Creative Cloud, SCCM, Intune, or Jamf, then verify the installed version matches the fixed release documented in the advisory.

Workarounds

Restrict Bridge to opening files from vetted, internal repositories using application allowlisting or file-origin policies.
Run Bridge under standard user accounts (never local administrators) to limit the impact of successful exploitation.
Block inbound delivery of Bridge-associated file extensions from external senders at the email gateway pending patch deployment.

bash

# Verify the installed Adobe Bridge version on Windows
reg query "HKLM\SOFTWARE\Adobe\Bridge" /s | findstr /i "Version"

# Verify the installed Adobe Bridge version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Bridge 2026/Adobe Bridge 2026.app"