EUVD-2026-51680
GHSA-w7m2-6chv-wg69
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsed attack requires local file open by victim (AV:L, UI:R); no system privileges needed by attacker (PR:N); full user-context code execution justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a specially crafted media or project file, running code in the context of the logged-in user. The attack is file-based and local, requiring an adversary to socially engineer a victim - a realistic threat vector for creative professionals who routinely receive media files from external sources. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the high CVSS impact metrics (C:H/I:H/A:H) indicate full user-level compromise upon successful exploitation.
Technical ContextAI
Adobe Premiere Pro is a professional non-linear video editing application widely used in broadcast, film, and media production environments. CWE-787 (Out-of-Bounds Write) indicates that during parsing or processing of a crafted input file - likely a media container, project file, or codec-related data structure - the application writes data beyond the allocated buffer boundary. This class of memory corruption vulnerability in native code (C/C++) is a well-understood mechanism for achieving arbitrary code execution: controlled out-of-bounds writes can overwrite adjacent heap or stack data, including function pointers or return addresses, redirecting execution flow. The CVSS vector AV:L confirms the attack surface is the local file-processing subsystem, not a network-exposed interface. The Adobe PSIRT reported this via the security bulletin APSB26-76.
RemediationAI
Apply the security update detailed in Adobe's official bulletin APSB26-76, available at https://helpx.adobe.com/security/products/premiere_pro/apsb26-76.html. The exact fixed version number is not confirmed from the input data and must be verified from the advisory directly - do not assume a version is safe without consulting APSB26-76. As a compensating control prior to patching, instruct users to avoid opening Premiere Pro project files, media files, or assets received from untrusted or unverified external sources. Organizations can also implement application sandboxing or restrict Premiere Pro execution via endpoint controls (e.g., AppLocker, WDAC on Windows) to limit the blast radius of exploitation to the sandboxed context. Note that restricting file ingestion may impact legitimate production workflows. Update Adobe Creative Cloud Desktop App to ensure auto-update delivery of the patch if deployed in managed environments.
More in Premiere Pro
View allPremiere Pro versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Arbitrary code execution in Adobe Premiere Pro (versions 26.0.2, 25.6.4 and earlier) stems from a Use-After-Free memory
Arbitrary code execution in Adobe Premiere Pro 26.0.2, 25.6.4 and all earlier versions arises from an out-of-bounds writ
Arbitrary code execution in Adobe Premiere Pro (versions 26.0.2, 25.6.4 and earlier) arises from an out-of-bounds write
Code execution in Adobe Premiere Pro 25.5 and earlier via out-of-bounds read when processing malicious media files. An a
Premiere Pro versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Premiere Pro versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds write vulnerability that could result in
Premiere Pro versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in
Premiere Pro versions 24.1, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerabilit
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today