EUVD-2026-44447
GHSA-rvrg-6mx8-rph8
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing flaw needing the victim to open a malicious file (AV:L/UI:R), no prior privileges (PR:N), yielding full code execution in the user's context (C/I/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Media Encoder is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Media Encoder arises from a stack-based buffer overflow (CWE-121) triggered when a victim opens a maliciously crafted media file, allowing an attacker to run code in the context of the current user. The CVSS 3.1 base score is 7.8 (local vector, user interaction required, no privileges needed). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is file-delivery-driven rather than remotely wormable.
Technical ContextAI
Adobe Media Encoder is a cross-platform media transcoding and rendering application, part of the Adobe Creative Cloud suite, used to encode audio/video into delivery formats and integrate with Premiere Pro and After Effects. The root cause is CWE-121 (Stack-based Buffer Overflow): while parsing a media/project file, the application copies attacker-controlled data into a fixed-size stack buffer without adequate bounds checking, corrupting the return address or adjacent stack data and enabling control-flow hijack. Because the parsing happens on the user's workstation when a file is opened, the affected component is the file-format/media parser rather than any network-facing service, consistent with the AV:L vector.
RemediationAI
Patch available per vendor advisory: update Adobe Media Encoder to the fixed release listed in Adobe security bulletin APSB26-72 (https://helpx.adobe.com/security/products/media-encoder/apsb26-72.html); the exact patched version string is not present in the supplied input, so pull it directly from that advisory and apply the vendor update or use the Creative Cloud desktop app's update mechanism. Because exploitation requires opening a malicious file, effective compensating controls until patching include restricting the opening of media/project files from untrusted or external sources, handling unsolicited files only in an isolated or sandboxed environment, and applying application-allowlisting/EDR to constrain child-process execution from Media Encoder - with the trade-off that these controls impede legitimate workflows that ingest external media and do not remove the underlying parser flaw.
More in Adobe Media Encoder
View allArbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, trigge
Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens
Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media f
Out-of-bounds read in Adobe Media Encoder exposes sensitive process memory when a victim opens a specially crafted media
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today