EUVD-2026-44335
GHSA-p476-v96c-q8mp
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File-based local delivery requires no attacker privileges; mandatory victim file-open sets UI:R; read-only CWE-125 nature yields C:H with I:N and A:N confirmed.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Audition is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or project file. Affected branches span Audition 26.x through 26.0 and 25.x through 25.6.4, with Adobe releasing corrective patches at 26.3 and 25.6.6 respectively per APSB26-71. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), indicating minimal current exploitation likelihood; SSVC likewise classifies exploitation as none and the attack as non-automatable.
Technical ContextAI
Adobe Audition is a professional digital audio workstation used widely in broadcast, podcast, and music production workflows. CWE-125 (Out-of-Bounds Read) identifies the root cause as a buffer boundary violation during file parsing - the application reads memory beyond the end of an allocated region, which can expose adjacent heap or stack contents. CPE data (cpe:2.3:a:adobe:audition) confirms both the 25.x and 26.x release trains are affected across all platforms. The 'Buffer Overflow' tag in the intelligence data suggests the flaw resides in a media format parsing component where buffer length is not properly validated before read operations, a classic pattern in multimedia codecs and proprietary project file parsers. The read-only nature of CWE-125 constrains impact to confidentiality - this is distinct from CWE-787 (out-of-bounds write) which would enable code execution.
RemediationAI
The primary remediation is to upgrade Adobe Audition to version 26.3 (for users on the 26.x track) or 25.6.6 (for users on the 25.x track), as released by Adobe and documented in Security Bulletin APSB26-71 (https://helpx.adobe.com/security/products/audition/apsb26-71.html). Updates can be applied through the Creative Cloud desktop application. Until patching is feasible, organizations should instruct users to avoid opening audio project files, session files, or media assets received from untrusted or unexpected sources. Disabling automatic file previews and restricting inbound file sharing from external parties through email gateway controls reduces the social engineering attack surface, though these controls do not protect users who legitimately process third-party audio content. No workarounds eliminate the underlying flaw.
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the conte
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a ma
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition 25.3 and earlier through a local out-of-bounds write vulnerability that requi
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vu
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 25.3 and earlier contain an out-of-bounds read vulnerability that exposes sensitive data from ap
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today