The CVSS 8.6 rating on this Adobe Bridge DLL hijacking vulnerability warrants skepticism. The EPSS probability of exploitation sits at 0.00169 — roughly five orders of magnitude lower than the severity score implies. That gap is not a reporting anomaly; it reflects a fundamental mismatch between theoretical blast radius and operational reality.
Untrusted search path vulnerabilities have a specific exploitation geometry that the CVSS score papers over. An attacker must place a malicious DLL in a directory that Adobe Bridge searches before the system directory, then trick the user into opening a file from that attacker-controlled location. This is not a drive-by scenario — it requires the target to open files from a directory the attacker already controls, which contradicts how creative professionals typically organize their asset workflows. The user interaction requirement here is not a soft mitigator; it functionally restricts exploitation to targeted spear-phishing rather than mass exploitation.
The 'scope changed' designation in the CVSS vector adds analytical noise rather than signal in this specific case. Adobe Bridge operates as a largely standalone asset browser — it does not share the deep session context, authentication tokens, or component directories that make other Creative Cloud applications architecturally interlinked. Unlike Photoshop or Illustrator, Bridge is not a hub for cloud sync agents or collaborative workflows. This means the scope boundary is narrower than the vector suggests; successful exploitation grants code execution on the local workstation, not the broader Creative Cloud session.
There is a separate dimension worth factoring: Adobe Bridge exists in maintenance twilight. It was discontinued and then revived, suggesting Adobe is keeping it functional rather than actively investing in its security posture. For a legacy application in this state, the likely remediation is a minimal binary-level fix — moving a DLL or renaming a loader call — rather than a genuine architectural fix of the unsafe search order. The CVE closes on paper, but the underlying technical debt remains in the codebase.
The practical takeaway: treat this as a compliance-driven disclosure rather than an active threat. Prioritize remediation based on your environment's exposure — if your workflows never involve opening Bridge files from untrusted network locations, the operational risk is negligible regardless of the 8.6 score. Monitor Adobe's patch cadence; given Bridge's maintenance status, expect a standard release cycle rather than emergency patching.