CVE-2026-103847

Received Received - Intake

Untrusted Search Path in Dimension Allows Arbitrary Code Execution

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Adobe Systems Incorporated

Description

Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103847

EUVD

EUVD-2026-100568

Affected Vendors & Products

Vendor	Product	Version / Range
Adobe	Adobe	Dimension 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

Executive Summary

This vulnerability is an Untrusted Search Path issue in Adobe Dimension that could allow arbitrary code execution. It requires user interaction, meaning a victim must run the application for exploitation. The scope is changed, indicating it affects components beyond the vulnerable one.

Detection Guidance

Detection of this vulnerability requires monitoring for suspicious activity or unauthorized code execution by users. Check for unexpected processes running under user permissions or unusual application behavior. Review system logs for applications launched with elevated privileges without proper authorization.

Impact Analysis

An attacker could exploit this to run malicious code on your system with the same permissions as your user account. This could lead to data theft, system compromise, or further attacks within your network.

Compliance Impact

This vulnerability could lead to arbitrary code execution, potentially exposing sensitive data. This may violate GDPR's data protection requirements and HIPAA's security rules if exploited in systems handling personal or health information.

Mitigation Strategies

Update Adobe Dimension to the latest version to patch the vulnerability. Avoid running untrusted applications or files. Restrict user permissions to minimize impact if exploitation occurs.

Hi! I’m here to help you understand CVE-2026-103847. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70