EUVD-2026-44336
GHSA-j6jx-2f3j-95x2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally (AV:L, UI:R) with no prior privileges (PR:N); memory-corruption code execution yields full C/I/A impact in the user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, letting an attacker run code with the privileges of the current user. The CVSS 3.1 base score is 7.8 (local vector, requires user interaction), and no public exploit has been identified at time of analysis. Reported by Adobe via advisory APSB26-71.
Technical ContextAI
Adobe Audition is a professional digital audio workstation used for recording, mixing, editing, and restoring audio, part of the Adobe Creative Cloud suite. The root cause is classified as CWE-787 (Out-of-bounds Write), a memory-corruption weakness in which the application writes data past the bounds of an allocated buffer - here almost certainly within the parsing/decoding logic for an audio or session file format. The affected CPE is cpe:2.3:a:adobe:audition (all versions marked by wildcard in the feed, meaning specific fixed builds are enumerated in the vendor advisory rather than the CPE). Out-of-bounds writes of this kind allow an attacker to corrupt adjacent heap or stack memory and, with careful crafting of the malicious file, redirect execution flow to attacker-controlled code.
RemediationAI
Apply the updated version of Adobe Audition as specified in Adobe advisory APSB26-71 (https://helpx.adobe.com/security/products/audition/apsb26-71.html); the exact fixed build number is listed there and was not included in the raw input, so it is not reproduced here to avoid inventing a version. Update via the Creative Cloud desktop application or by installing the patched release directly. As compensating controls until patching is complete, do not open Audition project or audio files received from untrusted or unsolicited sources, restrict file associations so untrusted media does not auto-open in Audition, and consider running the application under a least-privileged user account so that code execution inherits minimal privileges. These controls reduce but do not eliminate risk, since a determined user can still be socially engineered into opening a malicious file.
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the conte
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a ma
Arbitrary code execution in Adobe Audition 25.3 and earlier through a local out-of-bounds write vulnerability that requi
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vu
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or p
Adobe Audition versions 25.3 and earlier contain an out-of-bounds read vulnerability that exposes sensitive data from ap
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today