EUVD-2026-44508
GHSA-9mp5-882h-8w67
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector (AV:L) needing victim to open the file (UI:R), no privileges (PR:N), with memory-corruption code execution yielding full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media file corrupt memory and run attacker-controlled code in the context of the current user. Any user who opens a malicious file in the affected desktop application is at risk, with full loss of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Adobe Media Encoder is a cross-platform desktop application used to transcode, render, and export audio/video media, and it parses a wide range of untrusted container and codec formats. The root cause is CWE-787 (Out-of-bounds Write): during parsing of a malformed media file, the application writes past the bounds of an allocated buffer - the tags 'Memory Corruption' and 'Buffer Overflow' point to classic heap/stack overflow behavior in the file-parsing path. Because the write corrupts adjacent memory, an attacker who controls the malformed input can steer execution to arbitrary code that runs with the same privileges as the user opening the file. The CPE strings (cpe:2.3:a:adobe:adobe_media_encoder:*) confirm the affected component is the Adobe Media Encoder application itself rather than an underlying shared library.
RemediationAI
Patch available per vendor advisory: apply the fixed version of Adobe Media Encoder distributed by Adobe as described in bulletin APSB26-72 (https://helpx.adobe.com/security/products/media-encoder/apsb26-72.html); the exact fixed build number is not included in the provided data and should be taken directly from that advisory, then deployed via the Creative Cloud desktop app or Adobe's admin/enterprise update channels. As compensating controls until patching completes, restrict opening or importing media files from untrusted or external sources into Media Encoder, and use email/web gateway filtering plus OS file-reputation and application allow-listing to reduce the chance a user opens a weaponized file - the trade-off is added friction for legitimate media ingestion workflows. Running the application under a least-privileged, non-administrative user account limits the blast radius of code execution but does not prevent exploitation itself.
More in Adobe Media Encoder
View allArbitrary code execution in Adobe Media Encoder arises from a stack-based buffer overflow (CWE-121) triggered when a vic
Arbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, trigge
Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens
Out-of-bounds read in Adobe Media Encoder exposes sensitive process memory when a victim opens a specially crafted media
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today