High severity · published Oct 13, 2026
CVE-2026-103847
Dimension | Untrusted Search Path (CWE-426)
8.6
CVSS
0.2%
EPSS
No
On KEV
Description
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Adobe Dimension · Adobe
through 4.1.8 · source: vendor
Affected product
AD
Adobe Dimension
Adobe
More from Adobe Dimension
8.6
CVE-2026-103846
Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)
8.6
CVE-2026-103845
Dimension | Uncontrolled Search Path Element (CWE-427)
7.8
CVE-2026-103844
Dimension | Out-of-bounds Write (CWE-787)
7.8
CVE-2026-103854
Dimension | Stack-based Buffer Overflow (CWE-121)
5.5
CVE-2026-103855
Dimension | NULL Pointer Dereference (CWE-476)