{"id":"CVE-2026-118483","kind":"vulnerability","aliases":["CVE-2026-118483"],"related":[],"title":"Adobe Dimension for macOS: malicious file can run code (fixed in 4.1.10)","description":"Dimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","summary":"Adobe Dimension on macOS, version 4.1.9 and earlier, has an improper input validation flaw (CWE-20). Opening a malicious file can run code as the current user. Adobe fixed it in 4.1.10 and says it knows of no exploitation.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Dimension","fixed":["4.1.10"],"affected":"<= 4.1.9 (macOS)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe","desktop","dimension","macos","other","user-interaction"],"not_affected_if":["no-untrusted-files","windows"],"how_to_check":"In Adobe Dimension on macOS, open Dimension > About Dimension (or Creative Cloud app) and read the version. 4.1.9 or earlier is affected. Windows is not listed in the bulletin.","fix":"Update Adobe Dimension on macOS to 4.1.10 through the Creative Cloud app / Adobe Download Center.","status":"open","published_at":"2026-11-10T22:18:24+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","triaged_at":"2026-11-10T22:29:04+00:00","updated_at":"2026-11-10T22:39:59+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T22:29:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Dimension: improper input validation lets a malicious file run code","impact":"high","summary":"Dimension has an improper input validation flaw that lets a low-privileged attacker run arbitrary code as the current user. Exploitation requires a victim to open a malicious file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dimension"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"Arbitrary code runs as the logged-in user on the machine.","analyst_note":"Identify the vendor and affected versions of Dimension from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118483 and check for a vendor advisory with a fixed version.","how_to_check":"unknown","plain_action":"","product_name":"Dimension","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4557,"output_tokens":385,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and affected versions of Dimension from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118483 and check for a vendor advisory with a fixed version.","search":"'-118483':15A,18A '-20':43B '-2026':14A,17A '4.1.10':12A,59B '4.1.9':33B 'adob':1A,20B,28B,55B 'affect':69C 'arbitrari':80C,101C 'attack':94C 'chang':121C 'code':9A,50B,81C,102C 'context':85C 'could':77C,95C 'current':53B,88C 'cve':13A,16A 'cwe':42B 'desktop':21B 'dimens':2A,22B,29B,67C 'dimension':19A 'earlier':35B 'execut':82C,100C 'exploit':66B,96C,103C 'file':6A,47B,118C 'fix':10A,56B 'flaw':41B 'improp':38B,72C 'input':39B,73C 'interact':27B,109C 'issu':106C 'know':63B 'low':92C 'low-privileg':91C 'maco':4A,23B,31B 'malici':5A,46B,117C 'must':114C 'open':44B,115C 'privileg':93C 'requir':107C 'result':78C 'run':8A,49B 'say':61B 'scope':119C 'user':26B,54B,89C,108C 'user-interact':25B 'valid':40B,74C 'version':32B 'victim':113C 'vulner':75C,98C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Dimension 4.1.9 or earlier on macOS. An attacker needs you to open a malicious file, so teams that open 3D or design files from outside sources should update first. Windows is not listed in Adobe's bulletin, and nobody who doesn't use Dimension is affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:39:59Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/dimension/apsb26-190.html","run_id":3021},"products":{"at":"2026-11-10T22:39:59Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/dimension/apsb26-190.html","run_id":3021},"how_to_check":{"at":"2026-11-10T22:39:59Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/dimension/apsb26-190.html","run_id":3021},"who_affected":{"at":"2026-11-10T22:39:59Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/dimension/apsb26-190.html","run_id":3021}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dimension"],"ptokens":["dimension"],"labels":["adobe","desktop","dimension","high","macos","other","userinteraction","vendor"],"campaign_type":null,"search_a":"'-118483':15A,18A '-2026':14A,17A '4.1.10':12A 'adob':1A 'code':9A 'cve':13A,16A 'dimens':2A 'dimension':19A 'file':6A 'fix':10A 'maco':4A 'malici':5A 'run':8A","search_b":"'-20':43B '4.1.10':59B '4.1.9':33B 'adob':20B,28B,55B 'code':50B 'current':53B 'cwe':42B 'desktop':21B 'dimens':22B,29B 'earlier':35B 'exploit':66B 'file':47B 'fix':56B 'flaw':41B 'improp':38B 'input':39B 'interact':27B 'know':63B 'maco':23B,31B 'malici':46B 'open':44B 'run':49B 'say':61B 'user':26B,54B 'user-interact':25B 'valid':40B 'version':32B","search_c":"'affect':69C 'arbitrari':80C,101C 'attack':94C 'chang':121C 'code':81C,102C 'context':85C 'could':77C,95C 'current':88C 'dimens':67C 'execut':82C,100C 'exploit':96C,103C 'file':118C 'improp':72C 'input':73C 'interact':109C 'issu':106C 'low':92C 'low-privileg':91C 'malici':117C 'must':114C 'open':115C 'privileg':93C 'requir':107C 'result':78C 'scope':119C 'user':89C,108C 'valid':74C 'victim':113C 'vulner':75C,98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118483","severity":null,"published_at":"2026-11-10T22:18:24+00:00","modified_at":"2026-11-10T22:18:24+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","fetched_at":"2026-11-10T22:27:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118483:3021","url":"https://www.adobe.com/trust/security/products/dimension/apsb26-190.html","severity":null,"published_at":"2026-11-10T22:39:59+00:00","modified_at":"2026-11-10T22:39:59+00:00","first_seen_at":"2026-11-10T22:39:59+00:00","fetched_at":"2026-11-10T22:39:59+00:00","note":"Adobe APSB26-190 (Nov 10 2026): macOS only, <=4.1.9 fixed in 4.1.10; Adobe not aware of exploitation. Windows not listed.","cites":["https://www.adobe.com/trust/security/products/dimension/apsb26-190.html"]}],"documents":[{"id":119703,"url":"https://www.adobe.com/trust/security/products/dimension/apsb26-190.html","title":"Adobe APSB26-190: Security update available for Adobe Dimension","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}