Adobe Audition CVE-2026-47969

Exploitation requires the victim to actively open a maliciously crafted file using an unpatched version of Adobe Audition (26.0 or earlier on the 26.x branch, or 25.6.4 or earlier on the 25.x branch). User interaction is mandatory - the vulnerability cannot be triggered through passive network exposure or without the victim's file-open action. The CVSS vector specifies PR:N, meaning the attacker requires no prior authentication or privileges on the target system; however, successful exploitation depends entirely on the victim's action of opening the malicious file. Impact is confined to memory disclosure (confidentiality only) with no integrity or availability consequences, limiting attacker utility post-exploitation. The attack is not automatable per SSVC, ruling out worm-like or mass exploitation scenarios. Non-default configurations or specific Audition features are not identified as prerequisites beyond standard file-open functionality.

The CVSS 3.1 score of 5.5 (Medium) is accurately calibrated for this vulnerability class. The local attack vector (AV:L) and mandatory user interaction (UI:R) significantly constrain real-world risk: an attacker cannot trigger the flaw remotely without a social engineering step that causes the victim to open a crafted file. High confidentiality impact (C:H) reflects that memory disclosure can leak sensitive in-process data, but the absence of integrity or availability impact limits post-exploitation utility. EPSS at 0.20% (10th percentile) is consistent with no known active exploitation and the non-automatable SSVC classification. The vulnerability is not listed in CISA KEV, and no POC has been identified. Cross-referencing these signals: this is a genuine but low-urgency patching priority - the primary threat model is targeted attacks against media professionals via crafted file delivery, not opportunistic mass exploitation. There are no conflicting signals in the available data.

An attacker crafts a malicious audio project file or media asset engineered to trigger the out-of-bounds read in Audition's file parser, then delivers it to a target media professional via email attachment, a shared cloud storage link, or a compromised asset repository. When the victim opens the file in an unpatched version of Audition, the parser reads beyond the allocated buffer boundary, disclosing memory contents - potentially including credentials, tokens, or sensitive project data resident in the process. No public proof-of-concept code has been identified at the time of this analysis.