CVE-2026-75656
📛 CVE Title
Bridge | Out-of-bounds Read (CWE-125)
Description
Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- adobe
- CVSS severity
- MEDIUM
- CVSS score
- 5.5 / 10
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N- Effective score
- 5.5 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-125 - Reserved
- 2026-08-18
- Published
- 2026-09-22 18:52 UTC
- Last updated
- 2026-09-22 18:52 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75656.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-22 19:16:45 UTC
- NVD last modified
- 2026-09-22 19:23:57 UTC
- NVD CVSS v3.1
- 5.5 / 10 MEDIUM source: psirt@adobe.com
- NVD CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N- Exploitability subscore
- 1.8 / 10
- Impact subscore
- 3.6 / 10
NVD / KEV / EPSS data refreshed 2026-09-23 02:44 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-84777 - Assigner
- adobe
- Published
- Sep 22, 2026, 6:52:21 PM
- Updated
- Sep 22, 2026, 6:52:21 PM
- EUVD base score (CVSS 3.1)
-
5.5 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - EUVD-reported EPSS
- 0.0000
- Vendors
- Adobe
- Products
-
Adobe Bridge (0 ≤16.0.6)Adobe Bridge (0 ≤15.1.7)
- Aliases
-
GHSA-4prx-hcjc-ggfq
ENISA description: Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
EUVD references (1)
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Adobe | Adobe Bridge |
0 (affected),
16.0.7 (unaffected)
|
— |
| Adobe | Adobe Bridge |
0 (affected),
15.1.8 (unaffected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://helpx.adobe.com/security/products/bridge/apsb26-148.html vendor-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://helpx.adobe.com/security/products/bridge/apsb26-148.html psirt@adobe.com
Remediations (10)
-
web:arcticwolf.com
Validate Group Policy and registry settings for Defender to ensure real-time protection, automatic remediation , and exclusion policies are secured. Temporary Workarounds Block Vulnerable Apps: Use Microsoft Defender Vulnerability Management to block or warn against execution of affected binaries for systems pending a patch .
2026-09-23 15:44 UTC -
web:cybernews.com
Microsoft's latest Patch Tuesday addressed 236 Windows bugs, only for the disgruntled researcher Nightmare Eclipse to show up and punch a massive privilege escalation hole. It isn't even new - the Windows Defender exploit bypasses the previous insufficient fix .
2026-09-23 15:44 UTC -
web:cyberpress.org
Microsoft has officially acknowledged a critical zero-day vulnerability in Microsoft Defender, publicly dubbed "RoguePlanet," and confirmed it is actively developing a security patch to address the flaw.
2026-09-23 15:44 UTC -
web:dailysecurityreview.com
Microsoft confirmed CVE - 2026 -50656, a zero-day in the Defender Malware Protection Engine allowing SYSTEM-level privilege escalation, is under active exploitation with no patch currently available.
2026-09-23 15:44 UTC -
web:labs.cloudsecurityalliance.org
RoguePlanet: Microsoft Defender Zero-Day CVE - 2026 -50656 Key Takeaways CVE - 2026 -50656 ("RoguePlanet") is an unpatched privilege escalation zero-day in the Microsoft Malware Protection Engine that grants attackers SYSTEM-level access on fully patched Windows 10 and Windows 11 systems.
2026-09-23 15:44 UTC -
web:securityaffairs.com
Microsoft fixed RoguePlanet ( CVE - 2026 -50656), a Defender flaw allowing local attackers to gain higher privileges through the Malware Protection Engine. Microsoft released security updates for RoguePlanet, a vulnerability tracked as CVE - 2026 -50656 (CVSS score of 7.8) affecting the Malware Protection ...
2026-09-23 15:44 UTC -
web:securityarsenal.com
A public PoC claims to bypass Microsoft's fix for CVE - 2026 -50656, a 7.8 CVSS Microsoft Defender flaw enabling SYSTEM-level access. Defenders must hunt now.
2026-09-23 15:44 UTC -
web:windowsforum.com
ShieldBreak, a newly published proof of concept from the researcher known as Nightmare Eclipse, claims to bypass Microsoft's July fix for the Microsoft Defender privilege-escalation flaw CVE - 2026 -50656, better known as RoguePlanet.
2026-09-23 15:44 UTC -
web:www.sentinelone.com
CVE - 2026 -50656 is an elevation of privilege vulnerability in Microsoft Malware Protection Engine. Learn about its impact, affected versions, and mitigation .
2026-09-23 15:44 UTC -
web:www.techtimes.com
Windows Defender zero-day CVE - 2026 -50656 — known as RoguePlanet — has been patched by Microsoft 29 days after researcher Nightmare Eclipse published working exploit code granting SYSTEM-level ...
2026-09-23 15:44 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-75656.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Adobe Bridge",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "16.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.0.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Adobe Bridge",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "15.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.1.8",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-09-22T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 5.5,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "NONE",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "UNCHANGED",
"modifiedUserInteraction": "REQUIRED",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 5.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read (CWE-125)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:52:21.398Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/bridge/apsb26-148.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Bridge | Out-of-bounds Read (CWE-125)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2026-75656",
"datePublished": "2026-09-22T18:52:21.398Z",
"dateReserved": "2026-08-18T01:29:54.615Z",
"dateUpdated": "2026-09-22T18:52:21.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}