CVE-2026-47906: Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)

Synopsis

This is a vulnerable third-party dependency issue in Adobe Dreamweaver Desktop versions 21.7 and earlier. The vulnerability requires local access and user interaction, specifically a victim must open a malicious file, but no authentication is needed to exploit it. Successful exploitation gives an attacker full arbitrary code execution in the context of the current user, covering confidentiality, integrity, and availability. No fix versions have been published yet; HarborGuard tracks the advisory and will flag a patched-image rebuild the moment Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-exposed service is required to trigger this vulnerability.

• AuthenticationNot required

  No account or credentials are required; any unauthenticated party who can deliver a malicious file to the victim can attempt exploitation.

• Victim interactionRequired

  The victim must open a malicious file, making social engineering or a malicious file delivery the necessary attack vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• Executes arbitrary code as the current user, giving the attacker full control over that user session and any resources accessible to it.
• Reads any files, credentials, tokens, or secrets accessible to the current user account on the host.
• Modifies or deletes files and data owned by the current user, including project files, configurations, and local application state.
• Crashes or destabilizes the Dreamweaver Desktop process and any dependent workflows running under the affected user context.