EUVD-2026-44333
GHSA-v9xm-f8hh-498f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open exploit needs victim interaction (AV:L/UI:R) and no attacker privileges (PR:N); code execution as current user yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, letting an attacker run code in the context of the current user. The flaw was reported by Adobe and is documented in advisory APSB26-71; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation is local and requires user interaction, it is a file-format/client-side memory-corruption issue rather than a remotely-triggerable server flaw.
Technical ContextAI
Adobe Audition is a professional digital audio workstation used for recording, mixing, and restoration; like most media applications it parses many complex, attacker-influenceable container and codec formats. The root cause is classed as CWE-787 (Out-of-bounds Write), consistent with the 'Memory Corruption / Buffer Overflow' tags: when Audition parses a malformed file, a length or index value is mishandled so that data is written past the bounds of an allocated buffer, corrupting adjacent heap/stack memory. Controlled out-of-bounds writes of this type are a classic primitive for hijacking control flow (overwriting return addresses, function pointers, or object vtables) to achieve arbitrary code execution. The affected products are identified by CPE cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*, but the CPE uses wildcard versions and does not pin the exact vulnerable range - the version boundary must be taken from the Adobe advisory.
RemediationAI
Apply the vendor update: consult Adobe security bulletin APSB26-71 (https://helpx.adobe.com/security/products/audition/apsb26-71.html) and upgrade Adobe Audition to the fixed version listed there via the Creative Cloud desktop app's update mechanism - patch available per vendor advisory (the exact fixed build is specified in APSB26-71 and was not restated in this input, so cite the advisory's version rather than an invented number). Because exploitation requires a user to open a malicious file, effective compensating controls until patching completes are: instruct users not to open Audition project or audio files from untrusted or unsolicited sources; enforce mark-of-the-web / attachment filtering so downloaded media files are treated as untrusted; and open suspect files only in an isolated or sandboxed environment. These controls rely on user discipline and do not fix the underlying memory-corruption bug, so patching remains the only durable remediation.
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the conte
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a ma
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition 25.3 and earlier through a local out-of-bounds write vulnerability that requi
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vu
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or p
Adobe Audition versions 25.3 and earlier contain an out-of-bounds read vulnerability that exposes sensitive data from ap
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today