EUVD-2026-44457
GHSA-2xgr-v72x-5hhg
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no prior privileges (PR:N); memory-corruption code execution yields full high impact to C/I/A within the user's scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Premiere Pro is possible when a victim opens a maliciously crafted project or media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw was reported by Adobe (advisory APSB26-76) and carries a CVSS 3.1 base score of 7.8 (local vector, requires user interaction). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim to open a malicious file in Adobe Premiere Pro - this user interaction (UI:R) is the mandatory precondition and the primary limiting factor; the vulnerability cannot be triggered remotely or without the target actively opening attacker-supplied content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 High) describes a local, low-complexity, unauthenticated-but-user-interaction-dependent flaw with high impact to confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Premiere Pro project or media file and delivers it to a video editor via email, a shared drive, or a client 'asset' handoff. When the editor opens the file, the out-of-bounds write is triggered and attacker-controlled code executes with the editor's privileges, giving the attacker a foothold on the workstation. … |
| Remediation | Apply the update released in Adobe Security Bulletin APSB26-76 (https://helpx.adobe.com/security/products/premiere_pro/apsb26-76.html) - patch available per vendor advisory; the exact fixed version was not included in the supplied data and should be read directly from that bulletin and deployed via the Creative Cloud desktop app or enterprise admin console. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Adobe Premiere Pro installations across the organization and issue an urgent security alert prohibiting users from opening .prproj files or media files from untrusted or unexpected sources; restrict administrative privileges for file import functions where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in Adobe Premiere Pro is possible via a heap-based buffer overflow (CWE-122) triggered when a v
Arbitrary code execution in Adobe Premiere Pro via an out-of-bounds write (CWE-787) that lets an attacker run code in th
Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today