EUVD-2026-44445
GHSA-vmgv-gqvj-7p7g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open exploitation (AV:L, UI:R) needs no prior privileges (PR:N) and yields full user-context code execution, giving high C/I/A with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw is local and requires user interaction, so it is not remotely wormable, but successful exploitation grants full compromise of the user's session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe published advisory APSB26-72 addressing the issue.
Technical ContextAI
Adobe Media Encoder is a cross-platform desktop application (Windows/macOS) used to transcode, render, and export audio/video across formats, frequently as a companion to Premiere Pro and After Effects. The root cause is CWE-787 (Out-of-bounds Write): the application parses a complex, attacker-controlled media/container file and writes past the bounds of an allocated memory buffer, corrupting adjacent memory (the tags confirm Memory Corruption / Buffer Overflow leading to RCE). Media codec and container parsers are a classic source of such bugs because they process deeply structured binary data with many size/offset fields that, if not validated, allow a malformed file to steer a write to an unintended address, ultimately hijacking control flow. The affected CPE is cpe:2.3:a:adobe:adobe_media_encoder (version wildcarded in the feed).
RemediationAI
Patch available per vendor advisory (APSB26-72): update Adobe Media Encoder to the fixed version listed by Adobe, distributed through the Creative Cloud desktop application, and consult https://helpx.adobe.com/security/products/media-encoder/apsb26-72.html for the exact patched build number (the input does not include a specific fixed version string, so use the version named in that advisory rather than an assumed number). Until patching is complete, reduce exposure by treating media and project files from untrusted or external sources as hostile: do not open unsolicited files, restrict which file types/sources users import, and consider running Media Encoder on standard (non-administrator) accounts so that code execution is confined to a lower-privilege context. Because exploitation depends entirely on opening a malicious file, user-awareness and mail/download filtering of media containers are effective compensating controls, though they cannot fully substitute for the patch and may add friction to legitimate media workflows.
More in Adobe Media Encoder
View allArbitrary code execution in Adobe Media Encoder arises from a stack-based buffer overflow (CWE-121) triggered when a vic
Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens
Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media f
Out-of-bounds read in Adobe Media Encoder exposes sensitive process memory when a victim opens a specially crafted media
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today