EUVD-2026-44458
GHSA-v5m2-8hhm-r6w2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user so AV:L and UI:R; no privileges needed (PR:N) and parsing bug is reliably triggerable (AC:L), yielding full user-context C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Premiere Pro via an out-of-bounds write (CWE-787) that lets an attacker run code in the context of the current user when a victim opens a maliciously crafted project or media file. The flaw is memory-corruption based and file-driven, requiring user interaction rather than network exposure; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Premiere Pro (UI:R) - the attack is local and file-format driven, not remotely triggerable over a network or via a running service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges, but mandatory user interaction, yielding full high impact to confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Premiere Pro project or media file that triggers the out-of-bounds write and delivers it to a target editor - for example via a shared client asset, a download link, or a compromised collaboration/asset-management workflow. When the victim opens the file in Premiere Pro, the memory corruption executes attacker-controlled code with the victim's privileges. … |
| Remediation | Apply the Adobe-released update for Premiere Pro as documented in advisory APSB26-76 (https://helpx.adobe.com/security/products/premiere_pro/apsb26-76.html); the exact fixed version number was not included in the provided data, so retrieve it from that bulletin and update via the Creative Cloud desktop app to the current patched build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, alert all Adobe Premiere Pro users to exercise extreme caution with external project files and media imports, audit and document which teams require active Premiere Pro access, and disable automatic media processing features where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in Adobe Premiere Pro is possible via a heap-based buffer overflow (CWE-122) triggered when a v
Arbitrary code execution in Adobe Premiere Pro is possible when a victim opens a maliciously crafted project or media fi
Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today