EUVD-2026-44458
GHSA-v5m2-8hhm-r6w2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user so AV:L and UI:R; no privileges needed (PR:N) and parsing bug is reliably triggerable (AC:L), yielding full user-context C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Premiere Pro via an out-of-bounds write (CWE-787) that lets an attacker run code in the context of the current user when a victim opens a maliciously crafted project or media file. The flaw is memory-corruption based and file-driven, requiring user interaction rather than network exposure; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS data was not provided, but the local, user-interaction-gated vector places this in the file-format/client-side attack category typical of Adobe desktop products.
Technical ContextAI
Adobe Premiere Pro is a professional desktop video-editing application that parses a wide range of complex media and project file formats (video, audio, image, and .prproj containers). The vulnerability is classified as CWE-787 (Out-of-bounds Write), the same memory-corruption root cause implied by the vendor tags 'Memory Corruption' and 'Buffer Overflow': while parsing a malformed file, the application writes past the bounds of an allocated buffer, corrupting adjacent heap or stack memory and enabling control-flow hijack. The CPE data (cpe:2.3:a:adobe:premiere:*) confirms the affected component is the Adobe Premiere application itself across unspecified versions; exact fixed builds are enumerated in Adobe advisory APSB26-76.
RemediationAI
Apply the Adobe-released update for Premiere Pro as documented in advisory APSB26-76 (https://helpx.adobe.com/security/products/premiere_pro/apsb26-76.html); the exact fixed version number was not included in the provided data, so retrieve it from that bulletin and update via the Creative Cloud desktop app to the current patched build. Because exploitation requires opening a malicious file, effective compensating controls until patching is complete include: only opening project and media files from trusted sources, treating unsolicited .prproj/media assets as untrusted attachments, and running Premiere Pro under a standard (non-administrative) user account so that code execution inherits reduced privileges (trade-off: does not prevent user-context compromise or data theft). Where feasible, sandbox or isolate media-ingest workstations and scan incoming third-party assets before import.
Arbitrary code execution in Adobe Premiere Pro is possible via a heap-based buffer overflow (CWE-122) triggered when a v
Arbitrary code execution in Adobe Premiere Pro is possible when a victim opens a maliciously crafted project or media fi
Arbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a s
Security feature bypass in Adobe Premiere Pro allows a local attacker to gain unauthorized write access by exploiting im
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today