EUVD-2026-44332
GHSA-px5j-8p9x-qp94
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Audition file
-
DeliveryDeliver via email or shared drive
-
ExploitVictim opens file in Audition
-
ExecutionTrigger out-of-bounds write
-
PersistCorrupt control memory
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted file in Adobe Audition - the CVSS vector (AV:L/UI:R) confirms local file-based delivery with mandatory user interaction, so there is no remote, unauthenticated, or automatic trigger. The attacker needs no pre-existing privileges (PR:N), but must convince the user to open the malicious Audition/media file, and the resulting code runs only at the current user's privilege level (S:U), not elevated. The practical limiting factors are the need for user interaction, reliance on social engineering to deliver the file, and that impact is confined to the context of the user who opened it. |
| Impact | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local attack vector combined with required user interaction, meaning exploitation depends on socially engineering a victim into opening a malicious file rather than any remote/network reachable service. Although PR:N technically means no prior privileges are needed, the practical barrier is UI:R (the victim must open the file), which sharply reduces automatability and makes this unsuitable for worming or mass exploitation. No EPSS score, KEV listing, or POC was provided, so all real-world-exploitation signals are currently absent; this reads as a genuine high-severity client-side code-execution flaw but not an active, widespread emergency. In SSVC terms this maps roughly to Exploitation=none, Automatable=no, Technical Impact=total - favoring scheduled patching over emergency out-of-band response, absent new evidence of exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious Audition project or audio file with a malformed length/size field and delivers it to a target audio engineer via email, a shared drive, or a download posing as a client's session files. When the victim opens the file in Adobe Audition, the out-of-bounds write corrupts memory and executes attacker-supplied code with the victim's user privileges. No public proof-of-concept was identified at time of analysis, and the local vector plus required user interaction make this a targeted, social-engineering-driven attack rather than a self-propagating one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a maliciously crafted media/project file, letting an attacker run code with the privileges of the current user. Affects Adobe Audition and was reported by Adobe under advisory APSB26-71. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS not provided.
RemediationAI
Update Adobe Audition to the fixed release identified in Adobe security bulletin APSB26-71 (https://helpx.adobe.com/security/products/audition/apsb26-71.html); the exact fix version is not included in the provided input data and should be taken directly from that advisory rather than assumed. Because exploitation requires a user to open a malicious file, the primary compensating control while patching is user-facing: do not open Audition project or media files from untrusted or unsolicited sources, and handle files of unknown provenance only in an isolated or sandboxed environment, which adds friction to legitimate collaboration workflows. Enterprises can also use application allowlisting and OS-level exploit mitigations (DEP, ASLR, CFG) and restrict which file types are auto-associated with Audition to reduce accidental opening, at the cost of some user convenience.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Audition is a professional digital audio workstation used for recording, mixing, editing, and restoring audio, and it parses a wide range of audio, session, and media container formats. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application writes past the bounds of an allocated buffer - typically because a length, index, or size field taken from an untrusted input file is not properly validated during parsing. Corrupting adjacent heap/stack memory can overwrite control data (function pointers, saved return addresses, object vtables), which a carefully constructed file can leverage to redirect execution flow and achieve code execution. The CPE data (cpe:2.3:a:adobe:audition) confirms the affected component is the Audition desktop application itself rather than a shared library or service.
Know when Audition gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based local vector (AV:L) needing victim to open a malicious file (UI:R) with no prior privileges (PR:N); memory-corruption RCE yields full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
A critical arbitrary code execution vulnerability in Adobe Audition (CVE-2026-48368) allows attackers to execute malicious code with user privileges when Audition users open crafted media files. With no patch currently available and an estimated 7.8 CVSS severity, organizations must implement immediate file-handling restrictions and user awareness measures to prevent exploitation through social engineering.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Audition to air-gapped or sandboxed environments; enforce file-type restrictions on email and file-sharing platforms; deploy EDR/XDR to detect anomalous child process activity originating from Audition; run Audition with least-privilege user accounts (non-administrative); implement application whitelisting to restrict Audition's execution to known safe locations; conduct targeted phishing and social engineering awareness training focused on file-based attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the conte
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition 25.3 and earlier through a local out-of-bounds write vulnerability that requi
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vu
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or p
Adobe Audition versions 25.3 and earlier contain an out-of-bounds read vulnerability that exposes sensitive data from ap
Exploit-DB