CVE-2021-21091: 
Adobe Bridge vulnerability analysis and mitigation

Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds read vulnerability when parsing a crafted HEIC file. This vulnerability was discovered and reported on December 9, 2020, and was publicly disclosed on April 15, 2021 (ZDI Advisory, Adobe Security Bulletin).

The vulnerability is classified as an Out-of-bounds read issue that occurs during the parsing of HEIC files. The specific flaw exists within the parsing of HEIC files and results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. The vulnerability has been assigned a CVSS score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) (ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Bridge. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

User interaction is required to exploit this vulnerability as the target must visit a malicious page or open a malicious file. The vulnerability requires local access and user interaction for successful exploitation (ZDI Advisory).

Adobe has issued an update to correct this vulnerability. Users are advised to update to the latest version of Adobe Bridge (Adobe Security Bulletin).