EUVD-2026-29611
GHSA-33p6-99p4-x6p2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open exploitation with required user interaction and no privileges; arbitrary code execution in current-user context yields high C/I/A with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Media Encoder (versions 26.0.2, 25.6.4 and earlier) stems from an out-of-bounds write (CWE-787) that executes in the context of the current user when a victim opens a crafted media file. No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), consistent with the SSVC 'Exploitation: none' assessment despite the total technical impact rating. Successful exploitation requires local user interaction, making this a file-lure attack rather than a remote-service threat.
Technical ContextAI
Adobe Media Encoder is a media transcoding and rendering application bundled with Adobe Creative Cloud that ingests and parses a wide range of audio/video container and codec formats. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class where the application writes past the bounds of an allocated buffer - typically triggered by malformed size, length, or offset fields in a media file's header or stream data during parsing. The affected CPE is cpe:2.3:a:adobe:media_encoder, and the tags (Memory Corruption, Buffer Overflow, RCE) confirm this is a heap/stack memory-safety defect in the file-parsing pipeline that an attacker controls via crafted input.
RemediationAI
Apply the vendor-released patch by updating Adobe Media Encoder to the fixed release identified in Adobe advisory APSB26-47 (https://helpx.adobe.com/security/products/media-encoder/apsb26-47.html); update via the Creative Cloud desktop app or enterprise deployment tooling - the exact fixed build should be confirmed from that advisory as the input data does not state a specific fixed version number beyond the affected 26.0.2 and 25.6.4 lines. Because exploitation requires opening a malicious file, effective compensating controls until patching are to avoid opening media files from untrusted or unsolicited sources, restrict which file types and sources are processed in automated encoding/watch-folder workflows (which can turn user interaction into unattended parsing), and run Media Encoder under least-privilege user accounts to limit the blast radius of code execution in the current-user context. These controls reduce exposure but do not remove the underlying memory-corruption flaw, so patching remains the only complete fix.
More in Media Encoder
View allAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds write vulnerability. Rated critical severity (CVSS 9
Adobe Media Encoder version 13.0.2 has a use-after-free vulnerability. Rated high severity (CVSS 8.8), this vulnerabilit
Media Encoder versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could re
Media Encoder versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result i
Arbitrary code execution in Adobe Media Encoder 26.0.2, 25.6.4 and earlier lets an attacker run code in the context of t
Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result i
Media Encoder versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could re
Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result i
Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds write vulnerability that could result i
Media Encoder versions 24.2.1, 23.6.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could
Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerabil
Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by a Heap-based Buffer Overflow vul
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today