{"id":"CVE-2026-104352","kind":"vulnerability","aliases":["CVE-2026-104352"],"related":[],"title":"Adobe Premiere: malicious file can run code as the user (APSB26-101)","description":"Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Premiere Pro has an out-of-bounds write flaw that lets an attacker run code in the context of the current user. Exploitation requires the victim to open a malicious file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Premiere","fixed":["27.0","26.5.3"],"affected":"<= 26.5.2; <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","desktop","macos","other","premiere","premiere-pro","windows"],"not_affected_if":["no-premiere-pro","version-26.5.3-or-later","version-27.0-or-later"],"how_to_check":"In Premiere, open Help > About and read the version. Exposed if it is 26.5.2 or earlier, or 25.6.6 or earlier (Windows and macOS). Managed fleets: check the installed version in the Creative Cloud Admin Console.","fix":"Update Adobe Premiere to 27.0, or to 26.5.3 if you stay on the 26.x line. The 25.6.x line has no fixed version in APSB26-101, which lists 25.6.6 and earlier as affected; move to 26.5.3 or 27.0. Update through Creative Cloud or the Download Center.","status":"open","published_at":"2026-11-10T21:17:39+00:00","first_seen_at":"2026-11-10T21:46:08+00:00","triaged_at":"2026-11-10T21:48:19+00:00","updated_at":"2026-11-10T22:03:17+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Premiere Pro: malicious file can run code as the user","impact":"high","summary":"Adobe Premiere Pro has an out-of-bounds write flaw that lets an attacker run code in the context of the current user. Exploitation requires the victim to open a malicious file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["premiere-pro","adobe","windows","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary code runs as the logged-in user after opening a file","analyst_note":"Find the affected Premiere Pro version ranges and Adobe's security bulletin for CVE-2026-104352 to confirm the fixed version.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-premiere-pro"],"who_is_affected":"Anyone who runs Adobe Premiere Pro and opens project or media files from untrusted sources may be exposed. Affected versions and the fixed release are not stated in the sources provided. Teams that do not use Premiere Pro can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4527,"output_tokens":443,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Premiere Pro version ranges and Adobe's security bulletin for CVE-2026-104352 to confirm the fixed version.","search":"'-101':12A '-104352':15A,18A '-2026':14A,17A 'adob':1A,21B,30B 'adobe':19A 'affect':66C 'apsb26':11A 'arbitrari':79C 'attack':44B 'bound':38B,72C 'code':7A,46B,80C 'context':49B,84C 'could':76C 'current':52B,87C 'cve':13A,16A 'desktop':22B 'execut':81C 'exploit':54B,89C 'file':4A,62B,104C 'flaw':40B 'interact':95C 'issu':92C 'let':42B 'maco':23B 'malici':3A,61B,103C 'must':100C 'open':59B,101C 'out-of-bound':35B,69C 'premier':2A,25B,27B,31B,63C 'premiere':20A 'premiere-pro':26B 'pro':28B,32B,64C 'requir':55B,93C 'result':77C 'run':6A,45B 'user':10A,53B,88C,94C 'victim':57B,99C 'vulner':74C 'window':29B 'write':39B,73C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Premiere (Windows or macOS) at 26.5.2 or earlier, or 25.6.6 or earlier, who opens a malicious file. Exploitation needs the user to open the file, and code runs as that user. Machines without Premiere can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:03:17Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2913},"products":{"at":"2026-11-10T22:03:17Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2913},"who_affected":{"at":"2026-11-10T22:03:17Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2913}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobepremiere","premiere"],"ptokens":["adobe","premiere"],"labels":["adobe","desktop","high","macos","other","premiere","premierepro","windows"],"campaign_type":null,"search_a":"'-101':12A '-104352':15A,18A '-2026':14A,17A 'adob':1A 'adobe':19A 'apsb26':11A 'code':7A 'cve':13A,16A 'file':4A 'malici':3A 'premier':2A 'premiere':20A 'run':6A 'user':10A","search_b":"'adob':21B,30B 'attack':44B 'bound':38B 'code':46B 'context':49B 'current':52B 'desktop':22B 'exploit':54B 'file':62B 'flaw':40B 'let':42B 'maco':23B 'malici':61B 'open':59B 'out-of-bound':35B 'premier':25B,27B,31B 'premiere-pro':26B 'pro':28B,32B 'requir':55B 'run':45B 'user':53B 'victim':57B 'window':29B 'write':39B","search_c":"'affect':66C 'arbitrari':79C 'bound':72C 'code':80C 'context':84C 'could':76C 'current':87C 'execut':81C 'exploit':89C 'file':104C 'interact':95C 'issu':92C 'malici':103C 'must':100C 'open':101C 'out-of-bound':69C 'premier':63C 'pro':64C 'requir':93C 'result':77C 'user':88C,94C 'victim':99C 'vulner':74C 'write':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104352","severity":null,"published_at":"2026-11-10T21:17:39+00:00","modified_at":"2026-11-10T21:17:39+00:00","first_seen_at":"2026-11-10T21:46:08+00:00","fetched_at":"2026-11-10T21:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104352:2913","url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","severity":null,"published_at":"2026-11-10T22:03:17+00:00","modified_at":"2026-11-10T22:03:17+00:00","first_seen_at":"2026-11-10T22:03:17+00:00","fetched_at":"2026-11-10T22:03:17+00:00","note":"Adobe APSB26-101 (Nov 10 2026) lists CVE-2026-104352 (OOB write, CWE-787, CVSS 7.8). Adobe is not aware of exploits in the wild. Fixed in 27.0 and 26.5.3. No PoC found.","cites":["https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"]}],"documents":[{"id":119283,"url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","title":"Adobe Premiere APSB26-101","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}