EUVD-2026-44446
GHSA-g3xr-8x2q-36jr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open exploitation gives local vector and UI:R; no attacker privileges needed (PR:N); arbitrary code execution as current user yields high C/I/A with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens a maliciously crafted media file, running attacker code in the context of the current user. The flaw was reported by Adobe and is addressed in advisory APSB26-72; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on user interaction (opening the file) and yields high impact to confidentiality, integrity, and availability.
Technical ContextAI
Adobe Media Encoder is a media transcoding and rendering application within the Adobe Creative Cloud suite, used to encode/export audio and video across formats. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class where the application writes past the bounds of an allocated buffer - typically while parsing malformed structures in an input media/project file. Such out-of-bounds writes can corrupt adjacent heap or stack memory and, when controlled, be leveraged to overwrite critical data or pointers and redirect execution. The CPE data (cpe:2.3:a:adobe:adobe_media_encoder) confirms the affected product is the Adobe Media Encoder application; specific version boundaries are not enumerated in the provided CPE (wildcard version fields).
RemediationAI
Apply the update referenced in Adobe security advisory APSB26-72 (https://helpx.adobe.com/security/products/media-encoder/apsb26-72.html) - Patch available per vendor advisory; the exact fixed version is not specified in the provided data, so obtain the target build directly from that advisory or via the Creative Cloud desktop app's update mechanism. Until patched, reduce exposure by treating Media Encoder project and media files from untrusted or unsolicited sources as dangerous and not opening them, and by restricting which users can process externally-sourced files on production/render workstations; note the trade-off is workflow friction for teams that routinely ingest third-party assets. Running Media Encoder under a least-privileged user account also limits the blast radius of code executed in the current user's context, at the cost of some administrative convenience.
More in Adobe Media Encoder
View allArbitrary code execution in Adobe Media Encoder arises from a stack-based buffer overflow (CWE-121) triggered when a vic
Arbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, trigge
Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media f
Out-of-bounds read in Adobe Media Encoder exposes sensitive process memory when a victim opens a specially crafted media
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today