EUVD-2026-44336
GHSA-j6jx-2f3j-95x2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Audition file
-
DeliveryDeliver to victim via email or share
-
ExploitVictim opens file in Audition
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim open an attacker-crafted malicious file in Adobe Audition - this user interaction (UI:R) is the primary gating condition and cannot be bypassed remotely. The attack is local (AV:L): the malicious file must be delivered to and opened on the target host, so there is no remote unauthenticated network path. No authentication or elevated privileges are needed by the attacker (PR:N), and code executes only in the context of the current user, so the blast radius is limited to that user's privilege level. The limiting factors are therefore social engineering (the victim must be induced to open the file) and the absence of any automated/network trigger. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High): exploitation is local and requires no prior privileges but does require user interaction - the AV:L reflects that the malicious file must reach and be opened on the victim's machine rather than exploited over a network. Impact is high across confidentiality, integrity, and availability because successful exploitation runs arbitrary code as the current user. There is no KEV listing (not confirmed actively exploited), no POC referenced, and no EPSS score supplied; combined with the required user interaction and local vector, real-world mass-exploitation risk is moderate rather than urgent. This is a classic file-format client-side memory-corruption bug: dangerous for targeted spear-phishing / malicious-document delivery against creative professionals, but not a wormable or server-side network threat. No conflicting signals were observed in the input. |
| Exploit ScenarioDerived | An attacker crafts a malicious Audition session or audio file embedding data that triggers the out-of-bounds write, then delivers it via email, a shared project, or a download link to a target audio engineer. When the victim opens the file in Adobe Audition, memory is corrupted and attacker-supplied code executes with the victim's privileges. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, letting an attacker run code with the privileges of the current user. The CVSS 3.1 base score is 7.8 (local vector, requires user interaction), and no public exploit has been identified at time of analysis. Reported by Adobe via advisory APSB26-71.
RemediationAI
Apply the updated version of Adobe Audition as specified in Adobe advisory APSB26-71 (https://helpx.adobe.com/security/products/audition/apsb26-71.html); the exact fixed build number is listed there and was not included in the raw input, so it is not reproduced here to avoid inventing a version. Update via the Creative Cloud desktop application or by installing the patched release directly. As compensating controls until patching is complete, do not open Audition project or audio files received from untrusted or unsolicited sources, restrict file associations so untrusted media does not auto-open in Audition, and consider running the application under a least-privileged user account so that code execution inherits minimal privileges. These controls reduce but do not eliminate risk, since a determined user can still be socially engineered into opening a malicious file.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Audition is a professional digital audio workstation used for recording, mixing, editing, and restoring audio, part of the Adobe Creative Cloud suite. The root cause is classified as CWE-787 (Out-of-bounds Write), a memory-corruption weakness in which the application writes data past the bounds of an allocated buffer - here almost certainly within the parsing/decoding logic for an audio or session file format. The affected CPE is cpe:2.3:a:adobe:audition (all versions marked by wildcard in the feed, meaning specific fixed builds are enumerated in the vendor advisory rather than the CPE). Out-of-bounds writes of this kind allow an attacker to corrupt adjacent heap or stack memory and, with careful crafting of the malicious file, redirect execution flow to attacker-controlled code.
Know when Audition gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally (AV:L, UI:R) with no prior privileges (PR:N); memory-corruption code execution yields full C/I/A impact in the user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Audition versions lack protection against arbitrary code execution when users open malicious media or project files. An attacker can exploit this vulnerability to gain unauthorized access at the user privilege level on affected workstations, potentially enabling data theft, ransomware deployment, or lateral movement within the organization.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Adobe Audition use to isolated workstations or containers with limited network and data access, implement file-type filtering and validation for media files at email and network boundaries, mandate security training for users on malicious file risks, require administrative approval before opening external media files, and maintain audit logging for all file-opening activities within Audition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the conte
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a ma
Arbitrary code execution in Adobe Audition 25.3 and earlier through a local out-of-bounds write vulnerability that requi
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vu
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or p
Adobe Audition versions 25.3 and earlier contain an out-of-bounds read vulnerability that exposes sensitive data from ap
Exploit-DB