EUVD-2026-44444
GHSA-xvq8-m3ch-hcjv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File parsing flaw triggered only when victim locally opens a malicious file; no integrity or availability impact - confidentiality-only memory disclosure.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds read in Adobe Media Encoder exposes sensitive process memory when a victim opens a specially crafted media file, enabling an attacker to obtain confidential runtime data. Affected branches are 25.x through 25.6.5 and 26.x through 26.2.2; patched releases 25.6.6 and 26.3 are available per Adobe APSB26-72. No active exploitation has been identified - EPSS sits at 0.24% (15th percentile) and SSVC rates exploitation as none - making this a moderate-priority patch for environments where Media Encoder handles untrusted media content.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) indicates that Adobe Media Encoder reads beyond the allocated buffer boundary during media file parsing, likely within a codec handler or container format parser. The affected CPE (cpe:2.3:a:adobe:adobe_media_encoder:*:*:*:*:*:*:*:*) spans all sub-versions of both the 25.x and 26.x release lines up to the patched versions. Adobe Media Encoder is a professional transcoding application that processes a wide variety of audio and video container formats, each with complex, parser-intensive binary structures that represent a recurring source of memory-safety vulnerabilities. An out-of-bounds read in this context can leak heap or stack contents - including pointers, cryptographic material, or cached data - adjacent to the misread buffer, without corrupting program state or crashing the application in a detectable way.
RemediationAI
Vendor-released patches are available: upgrade Adobe Media Encoder to version 26.3 for the 26.x branch or version 25.6.6 for the 25.x branch, as confirmed by EUVD-2026-44444 affected version data and Adobe Security Bulletin APSB26-72 at https://helpx.adobe.com/security/products/media-encoder/apsb26-72.html. Until patching is applied, the primary compensating control is to restrict Media Encoder to processing only media files from verified, trusted sources; organizations should advise users not to open media received via email, file-sharing platforms, or other untrusted channels in Media Encoder. Running Media Encoder in a sandboxed or least-privilege user environment can limit the sensitivity of memory contents accessible if a disclosure occurs, though this does not prevent the vulnerability from triggering.
More in Adobe Media Encoder
View allArbitrary code execution in Adobe Media Encoder arises from a stack-based buffer overflow (CWE-121) triggered when a vic
Arbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, trigge
Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens
Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media f
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today