{"id":"CVE-2021-42725","aliases":["ALPINE-CVE-2021-42725","BELL-CVE-2021-42725","EUVD-2021-29685","GHSA-gcmg-m9m3-j5jw"],"status":"published","title":"Adobe Bridge Memory Corruption could lead to Arbitrary code execution","description":"Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01963,"percentile":0.80611,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-788","CWE-863"],"published":"2021-11-16T21:14:28Z","modified":"2026-07-14T08:03:29Z","products":[{"vendor":"adobe","product":"bridge"}],"references":[{"url":"https://helpx.adobe.com/security/products/bridge/apsb21-94.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42725"},{"url":"https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html"},{"url":"https://github.com/advisories/GHSA-gcmg-m9m3-j5jw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-42725","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-42725","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-42725","title":"Adobe Bridge Memory Corruption could lead to Arbitrary code execution","description":"Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.","status":"published","published":"2021-11-16T21:14:28.247Z","modified":"2024-09-16T20:37:58.863Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-788"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2021-29685","description":"Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.","status":"published","published":"2021-11-16T21:14:28Z","modified":"2024-09-16T20:37:58Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:12.113193Z"}],"ghsa":[{"id":"GHSA-gcmg-m9m3-j5jw","title":"Adobe Experience Manager version 6.5.9.0 (and earlier) are affected by an improper access control...","description":"Adobe Experience Manager version 6.5.9.0 (and earlier) are affected by an improper access control vulnerability that leads to a security feature bypass. By manipulating referer headers, an unauthenticated attacker could gain access to arbitrary pages that they are not authorized to access.","status":"published","published":"2022-05-24T19:20:45Z","modified":"2023-07-04T05:01:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-788","CWE-863"],"updated_at":"2026-11-02T14:54:40.485503Z"}],"nvd":[{"id":"CVE-2021-42725","description":"Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.","status":"published","published":"2021-11-16T22:15:10.963Z","modified":"2026-06-17T04:10:01.23Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-788","CWE-119"],"updated_at":"2026-11-02T14:07:01.428028Z"}],"osv":[{"id":"ALPINE-CVE-2021-42725","description":"Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.","status":"withdrawn","published":"2021-11-16T22:15:10.963Z","modified":"2026-07-14T08:03:29.581237507Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-42725","title":"CVE-2021-42725 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:27.414254Z","modified":"2026-01-26T10:04:52.408804Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-42725","description":"Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.","status":"published","published":"2021-11-16T22:15:10.963Z","modified":"2026-03-14T11:15:28.427622Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"}]}}