EUVD-2026-44337
GHSA-3jcr-8gc7-5qpj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no attacker privileges (PR:N); memory-corruption RCE in current-user context yields full C/I/A impact (H) with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, allowing an attacker to run code in the context of the current user. The flaw is Adobe-reported (advisory APSB26-71) and carries a CVSS 7.8 (High) rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation is local and requires user interaction, weaponization depends on social engineering rather than remote automated attack.
Technical ContextAI
Adobe Audition is a professional digital audio workstation used for recording, mixing, and restoring audio. The vulnerability is a CWE-787 out-of-bounds write, a memory-corruption class in which the application writes data past the bounds of an allocated buffer - typically during parsing of a complex, attacker-controlled file format (audio, session, or import format). The provided CPE strings (cpe:2.3:a:adobe:audition:*) identify the affected product as Adobe Audition across unspecified versions; the wildcard version field means the CPE alone does not pin an exact range, so the vendor advisory must be consulted for precise builds. Out-of-bounds writes of this nature commonly stem from missing length validation in file-format parsers, and corruption of heap metadata or adjacent structures can be leveraged to redirect execution flow, which aligns with the RCE/Memory Corruption/Buffer Overflow tags.
RemediationAI
Apply the update referenced in Adobe Security Bulletin APSB26-71 (https://helpx.adobe.com/security/products/audition/apsb26-71.html); the input does not include an exact fixed version string, so consult that advisory for the precise patched build and update via the Creative Cloud desktop app or Adobe's update mechanism (Patch available per vendor advisory). Until patching is complete, the practical compensating control is procedural because the exploit requires opening a file: instruct users not to open Audition project or media files from untrusted or unsolicited sources, and route incoming third-party audio assets through a review or sandbox before opening - the trade-off is workflow friction for teams that regularly ingest client-supplied files. Where feasible, run Audition under a least-privileged user account so that code execution occurs in a constrained context rather than an administrative one, accepting that this does not prevent compromise of the current user's data.
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the conte
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a ma
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition 25.3 and earlier through a local out-of-bounds write vulnerability that requi
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vu
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or p
Adobe Audition versions 25.3 and earlier contain an out-of-bounds read vulnerability that exposes sensitive data from ap
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today