EUVD-2026-44457
GHSA-2xgr-v72x-5hhg
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no prior privileges (PR:N); memory-corruption code execution yields full high impact to C/I/A within the user's scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Premiere Pro is possible when a victim opens a maliciously crafted project or media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw was reported by Adobe (advisory APSB26-76) and carries a CVSS 3.1 base score of 7.8 (local vector, requires user interaction). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently driven by the ease of social-engineering a user into opening a booby-trapped file.
Technical ContextAI
Adobe Premiere Pro is a professional non-linear video editing application that parses a wide range of complex, attacker-influenceable file formats (project files, sequences, and embedded media/codec streams). The vulnerability class is CWE-787 (out-of-bounds write), tagged by the source as memory corruption / buffer overflow: during parsing of malformed file data the application writes past the bounds of an allocated buffer, corrupting adjacent memory. When the corrupted memory includes control data (function pointers, return addresses, object vtables), an attacker can steer execution to their own payload, achieving arbitrary code execution. The CPE data (cpe:2.3:a:adobe:premiere:*) confirms the Adobe Premiere application as the affected product but does not pin exact version boundaries - those must be read from the Adobe advisory.
RemediationAI
Apply the update released in Adobe Security Bulletin APSB26-76 (https://helpx.adobe.com/security/products/premiere_pro/apsb26-76.html) - patch available per vendor advisory; the exact fixed version was not included in the supplied data and should be read directly from that bulletin and deployed via the Creative Cloud desktop app or enterprise admin console. Until patching is complete, the practical compensating control is to avoid opening Premiere Pro project or media files from untrusted or unsolicited sources, and to treat shared .prproj files and third-party media as potentially hostile; organizations can enforce this by restricting which network locations/email attachments users can open and by running Premiere under least-privilege accounts so that code execution is confined to a low-privilege user context. These controls reduce likelihood but do not remove the vulnerability, and the least-privilege trade-off may inconvenience editors who need broader system access.
Arbitrary code execution in Adobe Premiere Pro is possible via a heap-based buffer overflow (CWE-122) triggered when a v
Arbitrary code execution in Adobe Premiere Pro via an out-of-bounds write (CWE-787) that lets an attacker run code in th
Arbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a s
Security feature bypass in Adobe Premiere Pro allows a local attacker to gain unauthorized write access by exploiting im
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today