EUVD-2026-44332
GHSA-px5j-8p9x-qp94
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based local vector (AV:L) needing victim to open a malicious file (UI:R) with no prior privileges (PR:N); memory-corruption RCE yields full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a maliciously crafted media/project file, letting an attacker run code with the privileges of the current user. Affects Adobe Audition and was reported by Adobe under advisory APSB26-71. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS not provided.
Technical ContextAI
Adobe Audition is a professional digital audio workstation used for recording, mixing, editing, and restoring audio, and it parses a wide range of audio, session, and media container formats. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application writes past the bounds of an allocated buffer - typically because a length, index, or size field taken from an untrusted input file is not properly validated during parsing. Corrupting adjacent heap/stack memory can overwrite control data (function pointers, saved return addresses, object vtables), which a carefully constructed file can leverage to redirect execution flow and achieve code execution. The CPE data (cpe:2.3:a:adobe:audition) confirms the affected component is the Audition desktop application itself rather than a shared library or service.
RemediationAI
Update Adobe Audition to the fixed release identified in Adobe security bulletin APSB26-71 (https://helpx.adobe.com/security/products/audition/apsb26-71.html); the exact fix version is not included in the provided input data and should be taken directly from that advisory rather than assumed. Because exploitation requires a user to open a malicious file, the primary compensating control while patching is user-facing: do not open Audition project or media files from untrusted or unsolicited sources, and handle files of unknown provenance only in an isolated or sandboxed environment, which adds friction to legitimate collaboration workflows. Enterprises can also use application allowlisting and OS-level exploit mitigations (DEP, ASLR, CFG) and restrict which file types are auto-associated with Audition to reduce accidental opening, at the cost of some user convenience.
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the conte
Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a
Arbitrary code execution in Adobe Audition 25.3 and earlier through a local out-of-bounds write vulnerability that requi
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vu
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Rated high severity (CVSS 7.8), th
Out-of-bounds read in Adobe Audition exposes sensitive process memory when a victim opens a specially crafted media or p
Adobe Audition versions 25.3 and earlier contain an out-of-bounds read vulnerability that exposes sensitive data from ap
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today