Adobe Dimension: Improper input validation allows code execution
Summary
Adobe Dimension contains an improper input validation flaw (CVE-2026-118483) that can lead to arbitrary code execution in the context of the current user. A low-privileged local attacker can exploit it if a victim opens a malicious file, so the attack requires user interaction. The CVSS score is 8.2 (High) with a changed scope.
Affected
- Adobe Dimension 0 through 4.1.9 (CVE record)
- The Adobe bulletin APSB26-190 lists macOS as the affected platform.
Fixed in
- Adobe Dimension 4.1.10 (macOS, per Adobe bulletin APSB26-190)
Workaround
Unknown. No vendor workaround identified.
- Until the update is installed, do not open untrusted or unexpected 3D or design files in Dimension.
Exploitation
- Adobe is not aware of any exploits in the wild.
- Not listed as known exploited by OffSeq or Strix; not listed in CISA KEV according to Strix.
- Public proof of concept: Unknown.
Our recommendation
- Update Adobe Dimension to version 4.1.10 or later within the normal monthly patch cycle.
- Identify all systems with Dimension installed and check their versions.
- Treat unexpected design or 3D files received by email or download with caution, and open them only from trusted sources.
- Monitor NVD for the final analysis of the CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-190 www.adobe.com
- CVE Record CVE-2026-118483 www.cve.org
- Adobe Security Bulletin APSB26-171 (previous Dimension update) www.adobe.com
- ZDI November 2026 security update review www.zerodayinitiative.com
- OffSeq threat radar CVE-2026-118483 radar.offseq.com
- Strix CVE-2026-118483 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:26.
Original description (NVD)
Dimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.