CVE-2026-47908: Dreamweaver Desktop | Access of Uninitialized Pointer (CWE-824)

Synopsis

An access-of-uninitialized-pointer vulnerability affects Adobe Dreamweaver Desktop versions 21.7 and earlier. The flaw is triggered locally when a user opens a specially crafted file, requiring no network exposure but needing the victim to interact with malicious content. Successful exploitation gives an attacker full arbitrary code execution in the context of the logged-in user, enabling read, write, and disruption of anything that user can access. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as Adobe ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is reachable by any unprivileged process or user on the host who can deliver a file to the victim.

• Victim interactionRequired

  The victim must open a malicious file, making this a social-engineering vector that requires convincing the target to load attacker-supplied content in Dreamweaver Desktop.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, specific memory layout, or other environmental precondition beyond the victim opening the file.

Blast Radius

• Executes arbitrary code in the security context of the current user, giving the attacker full control over any process that user can launch.
• Reads files, credentials, and session tokens accessible to the logged-in user account.
• Writes or modifies files owned by that user, including project source code, configuration files, and local application data.
• Crashes or disrupts Dreamweaver Desktop and any co-dependent user-space processes.