Adobe Security Bulletin

Last updated on Oct 13, 2026

Security update available for Adobe Dimension | APSB26-171

Bulletin ID

Date published

Priority

APSB26-171

October 13, 2026

3

style

grid width 12

Summary

Adobe has released a priority 3 security update for Adobe Dimension. This update addresses vulnerabilities rated high and medium that could result in arbitrary code execution, application denial-of-service, and memory exposure.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Adobe Dimension

4.1.8 and earlier

Windows and macOS

style

grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Dimension

4.1.9

Windows and macOS

3

Download Center

style

grid width 12

Vulnerability Details

CVE-2026-103847

Vulnerability category: Untrusted Search Path (CWE-426)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE-2026-103846

Vulnerability category: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE-2026-103845

Vulnerability category: Uncontrolled Search Path Element (CWE-427)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE-2026-103844

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-103854

Vulnerability category: Stack-based Buffer Overflow (CWE-121)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-103855

Vulnerability category: NULL Pointer Dereference (CWE-476)
Vulnerability impact: Application denial-of-service
Severity: Medium
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2026-103853

Vulnerability category: Out-of-bounds Read (CWE-125)
Vulnerability impact: Memory exposure
Severity: Medium
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Acknowledgments

Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:

Kieran (kaiksi) — CVE-2026-103847, CVE-2026-103846, CVE-2026-103845
Jony (jony_juice) — CVE-2026-103844, CVE-2026-103854, CVE-2026-103855, CVE-2026-103853

NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories or email PSIRT@adobe.com.

CardTitle

APSB26-171

CardDescription

Priority 3 Security update

CardImage

Created

2026-10-13