EUVD-2026-44334
GHSA-hwj9-7pj4-px7r
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing bug triggered by opening a malicious file locally: AV:L and UI:R, no prior privileges (PR:N), and code execution yields full C/I/A impact within the user's context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the context of the current user when a victim opens a maliciously crafted media/project file. All affected versions covered by Adobe advisory APSB26-71 are impacted, and while no public exploit has been identified at time of analysis, the local attack vector with required user interaction makes it a classic file-format weaponization risk. The CVSS 7.8 (High) reflects full confidentiality, integrity, and availability impact once the file is opened.
Technical ContextAI
Adobe Audition is a professional digital audio workstation used for recording, mixing, and editing audio, and it parses a wide range of audio and session/project file formats. The root cause is CWE-787 (Out-of-bounds Write): the application's file parser writes data past the bounds of an allocated buffer - typically due to insufficient validation of length or index fields in a malformed file - corrupting adjacent heap or stack memory. Attacker control over the corrupted memory can be leveraged to hijack execution flow, which is why Adobe tags this as RCE / Memory Corruption / Buffer Overflow. The CPE data (cpe:2.3:a:adobe:audition) confirms the affected component is the Audition desktop application itself rather than a shared library or service.
RemediationAI
Apply the fixed version identified in Adobe Security Bulletin APSB26-71 (https://helpx.adobe.com/security/products/audition/apsb26-71.html); the exact patched build number is published in that advisory and should be deployed via Adobe Creative Cloud desktop app updates - the specific fix version is not included in the provided input data and must be read from the advisory rather than assumed. Until patching is complete, reduce exposure by instructing users not to open Audition project or audio files received from untrusted or unsolicited sources, restricting file associations so untrusted files do not auto-launch Audition, and where feasible opening suspect files only in an isolated/sandboxed workstation; the trade-off is workflow friction for editors who legitimately exchange session files. Running Audition under a standard (non-administrative) user account also limits post-exploitation impact since code executes in the current user's context.
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a ma
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition 25.3 and earlier through a local out-of-bounds write vulnerability that requi
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vu
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or p
Adobe Audition versions 25.3 and earlier contain an out-of-bounds read vulnerability that exposes sensitive data from ap
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today