EUVD-2026-29609
GHSA-63vg-v9rc-9v6p
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user, so AV:L and UI:R; no prior privileges needed (PR:N) and memory-corruption RCE yields full C:H/I:H/A:H at user scope (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Premiere Pro 26.0.2, 25.6.4 and all earlier versions arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted project or media file, running attacker code in the context of the current user. The flaw is vendor-reported (Adobe APSB26-46) with no public exploit identified at time of analysis; EPSS is very low at 0.03% (7th percentile) and CISA SSVC records exploitation status as none, though technical impact is rated total. Exploitation is local and requires user interaction, so risk is bounded by social-engineering delivery rather than remote automated attack.
Technical ContextAI
Adobe Premiere Pro is a professional non-linear video editing application that parses a wide range of project, media, and codec container formats. The vulnerability class is CWE-787 (out-of-bounds write), a memory-corruption defect in which the application writes past the bounds of an allocated buffer - typically during parsing of malformed structures in an untrusted file. Because the affected CPE is cpe:2.3:a:adobe:premiere_pro:*:*:*:*:*:*:*:*, all channels of the product up to the fixed release are implicated. A controlled out-of-bounds write can corrupt adjacent heap metadata or function pointers, and the tags (Memory Corruption, Buffer Overflow, RCE) indicate the write is leveraged toward control-flow hijack and native code execution rather than a simple crash.
RemediationAI
Update Adobe Premiere Pro to the fixed release identified in Adobe security bulletin APSB26-46 (https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html); the fix supersedes the affected 26.0.2 and 25.6.4 builds, and the exact patched version numbers should be taken directly from that advisory rather than assumed. Patch available per vendor advisory (APSB26-46); no exact fixed version string is present in the provided input, so confirm it on the Adobe page before deploying. Until updates are applied, the practical compensating control is to avoid opening Premiere Pro project or media files from untrusted or unsolicited sources and to restrict file-sharing channels that deliver such assets to editors; where feasible, open suspect files only in an isolated or sandboxed workstation, accepting the workflow friction this adds. Because exploitation depends entirely on the user opening a malicious file, user-awareness controls and email/download filtering meaningfully reduce exposure with minimal operational side effects.
More in Premiere Pro
View allArbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a s
Premiere Pro versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Arbitrary code execution in Adobe Premiere Pro (versions 26.0.2, 25.6.4 and earlier) stems from a Use-After-Free memory
Arbitrary code execution in Adobe Premiere Pro (versions 26.0.2, 25.6.4 and earlier) arises from an out-of-bounds write
Code execution in Adobe Premiere Pro 25.5 and earlier via out-of-bounds read when processing malicious media files. An a
Premiere Pro versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Premiere Pro versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds write vulnerability that could result in
Premiere Pro versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in
Premiere Pro versions 24.1, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerabilit
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today