CVE-2026-75655

Executive Summary

CVE-2026-75655 is an uncontrolled recursion (CWE-674) vulnerability in Adobe Bridge that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. Because the flaw grants high confidentiality, integrity, and availability impact under a single-user context, successful exploitation yields full compromise of the victim's workstation and the data accessible to that account.

Technical Analysis

The vulnerability class is uncontrolled recursion. Recursion is a control-flow construct in which a routine calls itself — directly or indirectly — until a terminating condition is met. When that terminating condition is absent, incorrect, or driven by attacker-controlled input, the depth of recursive calls grows without bound. The practical consequence is resource exhaustion on the call stack, commonly manifesting as a stack overflow.

CWE-674 is the canonical classification for this weakness. In memory-unsafe or native-code contexts, an uncontrolled recursion leading to stack exhaustion can corrupt adjacent memory and permit control-flow hijacking. The NVD description states that exploitation "could result in arbitrary code execution in the context of the current user," which is consistent with the corruption of stack-resident data (e.g., a return address or saved frame pointer) following deep or unbounded recursion while parsing attacker-supplied data.

The attack surface is the file-parsing path of Adobe Bridge. The NVD description explicitly establishes that the vector is file-based: the attacker supplies a malicious file, and the victim triggers the flaw simply by opening it. Adobe Bridge is a digital asset management application that opens, previews, and catalogs many media and document formats; file parsing is therefore core, routine functionality rather than an ancillary or unusual code path. The user does not need administrative privileges (PR:N) and the attacker requires no prior authentication.

CVSS v3.1 subscores align with this assessment:

• AV:L (Local): the attacker does not reach the target over the network directly; delivery is via a local file that the target opens.
• AC:L (Low): no special conditions beyond the user opening the file.
• PR:N (None): no privileges required.
• UI:R (Required): a victim must open the malicious file.
• S:U (Unchanged): impact remains within the security scope of the vulnerable component.
• C:H / I:H / A:H: full compromise of confidentiality, integrity, and availability in the user's context.

The base score of 7.8 is exactly what the vector above produces. The EPSS score is 0.00169, placing this CVE at the 5.5th percentile of exploited CVEs — i.e., exploitation activity is currently negligible in observed telemetry. There is no CISA KEV listing, no public PoC, no Nuclei template, and no published exploit code.

No public PoC is available; the following analysis is drawn strictly from the NVD description and the assigned CWE. Specific internal function names, parser routine names, and file-format entry points are not disclosed in the source data and are therefore not asserted here.

Exploitation Scenarios

The attack chain below is described at the vulnerability-class level, because the source description does not disclose implementation-specific detail. No public PoC is available.

1. Reconnaissance / target identification. The attacker identifies a target that uses Adobe Bridge as part of its creative or asset-management workflow. Because the vector is AV:L / UI:R, the realistic delivery models are those that place a crafted file where a Bridge user will open it: email attachment, shared network drive, cloud sync folder, chat file transfer, or a compromised download source. The attacker profiles the organization to determine which file types its Bridge users routinely handle, since the payload must resemble a legitimate asset.

2. Triggering the flaw class. The attacker crafts a file whose contents steer the vulnerable parsing logic into uncontrolled recursion. Per CWE-674, the trigger is input that causes a recursive routine to fail to reach its base case — for example, data that encodes self-referential or nested structure the parser pursues without a depth bound. The exact field, container, or format metadata that induces the recursion is not identified in the available source data. Delivery is completed when the victim opens the file in Adobe Bridge. Recursion depth increases with the crafted input until the call stack is exhausted.

3. Payload / execution method. The class-level expectation is stack exhaustion leading to memory corruption. The NVD description states that the outcome "could result in arbitrary code execution in the context of the current user." A reliable exploit typically requires precise control of stack layout and the ability to place a payload (such as shellcode) where execution can be redirected. Whether the recursion in this specific case is reliably weaponizable — versus producing a non-exploitable crash — cannot be determined from the information provided. Note: the source data does not specify the exact file format or parser entry point involved; any claim of a specific structure would be fabricated.

4. Post-exploitation impact. Code executes with the privileges of the Bridge user. From there, an attacker can read, modify, or exfiltrate files the user can access, install persistence in the user's profile, harvest credentials and session material available in that context, and pivot via the user's network shares and authenticated sessions. If the Bridge user holds elevated credentials or administrative rights, the blast radius widens accordingly. Because availability, confidentiality, and integrity impacts are each rated High (C:H/I:H/A:H), the post-exploitation ceiling is full compromise of the user's environment.

Detection of this chain depends heavily on execution-time and file-open telemetry, since the attacker's action and the victim's action are separated (a file is delivered, then later opened). This is where the detection content below is targeted.

Impact Assessment

• Confidentiality (C:H): arbitrary code execution in the user's context exposes all data readable by that user, including documents, cached credentials, and reachable network shares.
• Integrity (I:H): the attacker can alter or destroy the user's files and application data.
• Availability (A:H): the vulnerability can crash the application; weaponized exploitation may also destabilize the host.
• Privileges required (PR:N): the attacker needs no account or privileges on the target system.
• User interaction (UI:R): a user must open the malicious file. This is a meaningful social-engineering barrier, but it is also a mature, well-rehearsed delivery pattern in the creative-industries sector (malicious attachments and asset drops).
• Scope (S:U): impacts are contained within the vulnerable component's security authority, but in practice code executes with the user's rights across the host.

Blast radius is bounded primarily by the privileges of the user who opens the file. In creative, marketing, and media-production environments — where Adobe Bridge is common — workstations frequently hold elevated local rights, and users routinely open untrusted asset files as part of normal workflow, which raises the effective risk above a naive reading of AV:L.

Overall risk is currently moderated by the absence of public exploit code, the absence of a Nuclei template, no KEV listing, and an EPSS score of 0.00169 (5.5th percentile). In a targeted, low-volume operation, however, the detection gap posed by a file-triggered vulnerability is meaningful: the malicious file need not traverse the network perimeter if delivered on removable or already-synced media.

Detection Guidance

Sigma Rule

title: Adobe Bridge Uncontrolled Recursion Exploitation Attempt (CVE-2026-75655)
id: 7f3c1a92-5b4e-4d8a-9c21-0e6d4b7a1f55
status: experimental
description: Detects Adobe Bridge crashes or suspicious child processes consistent with exploitation of CVE-2026-75655, an uncontrolled recursion (CWE-674) file-parse vulnerability. Event selection targets unusual application faults followed by process execution from the Bridge context.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75655
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_bridge:
    Image|endswith:
      - '\Bridge.exe'
    ParentImage|endswith:
      - '\Bridge.exe'
  selection_susp_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_bridge and selection_susp_child
falsepositives:
  - Legitimate Bridge helpers or third-party plugins spawning scripting hosts
level: high
tags:
  - attack.execution
  - attack.t1204.002
  - cve.2026-75655

YARA Rule

rule CVE_2026_75655_Adobe_Bridge_Uncontrolled_Recursion
{
    meta:
        author      = "valtersit.com"
        description = "Heuristic detection for files that may trigger uncontrolled recursion (CWE-674) in Adobe Bridge. Low-specificity: uses depth-marker and nested-structure heuristics, expect false positives."
        cve         = "CVE-2026-75655"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-75655"
        date        = "2026-01-01"
        severity    = "high"

    strings:
        // Nested/repeated container markers frequently abused to drive unbounded recursion
        $m1 = "<container" ascii nocase
        $m2 = "<object" ascii nocase
        $m3 = "<?xml" ascii
        $m4 = "%%EOF" ascii
        $m5 = "obj" ascii

    condition:
        // XML/object-container input paired with high repetition of an opening token:
        // heuristic predicate for structure depth, not a format-specific signature.
        filesize < 20MB and
        (uint16(0) == 0x3C3F or uint16(0) == 0x4D42 or uint32(0) == 0x46445025) and
        (2 of ($m1, $m2, $m3)) and
        #m5 > 500
}

Note: no public PoC exists, so this rule is heuristic rather than signature-based. It is intended to flag candidate malformed assets for analyst triage and will require tuning against the organization's real Bridge file corpus.

Suricata IDS Rule

alert smb any any -> any any (msg:"CVE-2026-75655 Adobe Bridge Malicious File Transfer (SMB) - Possible Recursion Trigger"; flow:to_server,established; dce_iface:00000000-0000-0000-0000-000000000000; content:"|00|"; sid:202675655; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-75655, attack_target Client_Endpoint, deployment Perimeter; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75655;)

Note: the delivery channel for this CVE is file-based and the vulnerability is not itself network-exploitable. The rule above is a placeholder targeting SMB file transfer of candidate malicious assets and should be replaced or augmented once the responsible file type is identified. It is marked proximity-style and is expected to be noisy.

Elastic Detection

process where event.type == "start" and
  process.parent.name == "Bridge.exe" and
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")

Correlation: flag cases where an Adobe Bridge process is followed shortly after by a child scripting/interpreter process, or by a Windows Error Reporting entry for Bridge.exe immediately after a File Open operation.

Splunk SPL Query

index=endpoint (Image="*\\Bridge.exe" OR ParentImage="*\\Bridge.exe") 
| eval suspicious_child=if(match(Image, "(?i)\\\\(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$"), 1, 0)
| eval crash_indicator=if(match(_raw, "(?i)(exception_code|c00000fd|stack overflow|wermgr|faulting application)"), 1, 0)
| where suspicious_child=1 OR crash_indicator=1
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as cmdlines by host, User, ParentImage
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="adobe_bridge,cve_2026_75655,">
  <rule id="100755" level="12">
    <if_sid>61603,61604,61612</if_sid>
    <field name="win.eventdata.image">Bridge\.exe$</field>
    <field name="win.eventdata.parentImage">Bridge\.exe$</field>
    <description>CVE-2026-75655: Suspicious child process spawned by Adobe Bridge (possible arbitrary code execution)</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>cve_2026_75655,execution,</group>
  </rule>
  <rule id="100756" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">Bridge\.exe$</field>
    <field name="win.system.eventID">1000|1001</field>
    <description>CVE-2026-75655: Adobe Bridge application crash following file open (possible uncontrolled recursion / stack exhaustion)</description>
    <group>cve_2026_75655,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) claims a patch; this is not independently confirmed, and no vendor fix reference is available. Treat remediation status as unverified until Adobe publishes an advisory and fixed version.

1. Immediate mitigations

• Treat untrusted files as hostile until opened only in a sandboxed environment. Require approval before opening asset files received via email, chat, or file-sharing links.
• Restrict Adobe Bridge deployment where it is not operationally required; where it is required, run it in a hardened or virtualized context with no access to sensitive shares.
• Remove or tightly restrict write access to Bridge asset folders and any cloud sync folder reachable by Bridge to reduce delivery opportunities.
• Disable or constrain the browser/preview integration that allows arbitrary asset files to be opened with one click.
• Monitor for Adobe Bridge crash reports (Windows Error Reporting for Bridge.exe, Event IDs 1000/1001) and triage spikes as possible exploitation indicators.

2. Patch / upgrade steps

• Monitor Adobe's security bulletin channel for the official Bridge advisory for CVE-2026-75655 and the fixed version. Because the patch is only claimed by a single source, do not treat any version as fixed until Adobe confirms.
• When a fixed version is published, upgrade Bridge on all endpoints; validate the installed version against the vendor's fixed version before closing remediation tickets.
• If Adobe confirms no patch is forthcoming for a given release train, plan migration to a supported version.

3. Long-term hardening

• Enforce least privilege so that creative-station users do not hold local administrator rights; this directly caps the C:H/I:H/A:H impact by limiting post-exploitation reach.
• Apply application control/allowlisting to block unexpected child processes (scripting hosts, rundll32, regsvr32, mshta) from launching out of Bridge.
• Deploy EDR with stack-exhaustion and anomalous-child-process behavior monitoring for the full Adobe product suite, not just Bridge.
• Maintain an asset-intake policy: files from external parties are opened in a sandbox or converted through a trusted pipeline before reaching production workstations.
• Track Adobe advisories and integrate them into vulnerability management so the "claimed patch" status here is verified independently.

References

• NVD — CVE-2026-75655: https://nvd.nist.gov/vuln/detail/CVE-2026-75655
• MITRE CWE-674 — Uncontrolled Recursion: https://cwe.mitre.org/data/definitions/674.html
• MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application (context for remote attack surfaces): https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-75655 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS — score 0.00169 (5.5th percentile): https://api.first.org/data/v1/epss

Threat actor campaigns / exploit-in-the-wild evidence: none identified. No public PoC, no Nuclei template, no exploit code, and no KEV listing exist for this CVE at the time of writing. EPSS 0.00169 (5.5th percentile) indicates negligible observed exploitation probability.