{"id":"CVE-2026-110086","kind":"vulnerability","aliases":["CVE-2026-110086"],"related":[],"title":"Adobe Premiere: out-of-bounds write lets a malicious file run code as the current user","description":"Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Premiere Pro has an out-of-bounds write flaw that lets an attacker run code with the privileges of the logged-in user. Exploitation requires a victim to open a malicious file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Premiere","fixed":["26.5.3","27.0"],"affected":"<= 26.5.2; <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","creative-workstations","macos","other","premiere-pro","windows"],"not_affected_if":["files-from-trusted-sources-only","no-premiere-pro-installed"],"how_to_check":"In Premiere, open Help > About (Windows) or Premiere > About (macOS). Affected: 26.5.2 and earlier, or 25.6.6 and earlier. Fixed: 26.5.3 or 27.0. In managed fleets, check Creative Cloud Admin Console installed versions.","fix":"Update Adobe Premiere to 27.0, or to 26.5.3 if you stay on the 26.x line, via Creative Cloud or the Download Center (Adobe APSB26-101). Note: the 25.6.x line is listed as affected up to 25.6.6, and the bulletin gives no fixed 25.x version, so move to 26.5.3 or 27.0.","status":"open","published_at":"2026-11-10T21:18:19+00:00","first_seen_at":"2026-11-10T21:46:08+00:00","triaged_at":"2026-11-10T21:48:18+00:00","updated_at":"2026-11-10T22:02:19+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Premiere Pro: malicious file can run code as the current user","impact":"high","summary":"Adobe Premiere Pro has an out-of-bounds write flaw that lets an attacker run code with the privileges of the logged-in user. Exploitation requires a victim to open a malicious file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["premiere-pro","adobe","creative-workstations"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the logged-in user on the workstation","analyst_note":"Check Adobe's security bulletin for affected and fixed Premiere Pro versions; the NVD entry alone gives no version ranges.","how_to_check":"- Check the installed Premiere Pro version in the application's About screen or Help menu\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-premiere-pro-installed","files-from-trusted-sources-only"],"who_is_affected":"Anyone running an affected version of Adobe Premiere Pro who opens files from untrusted sources. The sources do not list affected version ranges. Teams that do not use Premiere Pro can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4527,"output_tokens":470,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for affected and fixed Premiere Pro versions; the NVD entry alone gives no version ranges.","search":"'-110086':20A,23A '-2026':19A,22A 'adob':1A,26B,36B 'adobe':24A 'affect':74C 'arbitrari':87C 'attack':50B 'bound':6A,44B,80C 'code':13A,52B,88C 'context':92C 'could':84C 'creativ':28B 'creative-workst':27B 'current':16A,95C 'cve':18A,21A 'execut':89C 'exploit':62B,97C 'file':11A,70B,112C 'flaw':46B 'interact':103C 'issu':100C 'let':8A,48B 'log':59B 'logged-in':58B 'maco':30B 'malici':10A,69B,111C 'must':108C 'open':67B,109C 'out-of-bound':3A,41B,77C 'premier':2A,33B,37B,71C 'premiere':25A 'premiere-pro':32B 'privileg':55B 'pro':34B,38B,72C 'requir':63B,101C 'result':85C 'run':12A,51B 'user':17A,61B,96C,102C 'victim':65B,107C 'vulner':82C 'window':35B 'workstat':29B 'write':7A,45B,81C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Premiere (Windows or macOS) at 26.5.2 or earlier, or 25.6.6 or earlier, who opens a crafted project or media file. Code runs with the logged-in user's rights (local attack vector, user must open the file). Teams that do not use Premiere, or only open files from trusted sources, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:02:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2910},"products":{"at":"2026-11-10T22:02:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2910},"how_to_check":{"at":"2026-11-10T22:02:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2910},"who_affected":{"at":"2026-11-10T22:02:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2910}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobepremiere","premiere"],"ptokens":["adobe","premiere"],"labels":["adobe","creativeworkstations","high","macos","other","premierepro","windows"],"campaign_type":null,"search_a":"'-110086':20A,23A '-2026':19A,22A 'adob':1A 'adobe':24A 'bound':6A 'code':13A 'current':16A 'cve':18A,21A 'file':11A 'let':8A 'malici':10A 'out-of-bound':3A 'premier':2A 'premiere':25A 'run':12A 'user':17A 'write':7A","search_b":"'adob':26B,36B 'attack':50B 'bound':44B 'code':52B 'creativ':28B 'creative-workst':27B 'exploit':62B 'file':70B 'flaw':46B 'let':48B 'log':59B 'logged-in':58B 'maco':30B 'malici':69B 'open':67B 'out-of-bound':41B 'premier':33B,37B 'premiere-pro':32B 'privileg':55B 'pro':34B,38B 'requir':63B 'run':51B 'user':61B 'victim':65B 'window':35B 'workstat':29B 'write':45B","search_c":"'affect':74C 'arbitrari':87C 'bound':80C 'code':88C 'context':92C 'could':84C 'current':95C 'execut':89C 'exploit':97C 'file':112C 'interact':103C 'issu':100C 'malici':111C 'must':108C 'open':109C 'out-of-bound':77C 'premier':71C 'pro':72C 'requir':101C 'result':85C 'user':96C,102C 'victim':107C 'vulner':82C 'write':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110086","severity":null,"published_at":"2026-11-10T21:18:19+00:00","modified_at":"2026-11-10T21:18:19+00:00","first_seen_at":"2026-11-10T21:46:08+00:00","fetched_at":"2026-11-10T21:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110086:2910","url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","severity":null,"published_at":"2026-11-10T22:02:19+00:00","modified_at":"2026-11-10T22:02:19+00:00","first_seen_at":"2026-11-10T22:02:19+00:00","fetched_at":"2026-11-10T22:02:19+00:00","note":"Read Adobe APSB26-101 (Nov 10 2026): affected Premiere 26.5.2 and earlier, 25.6.6 and earlier; fixed 27.0 / 26.5.3. No exploitation known per Adobe.","cites":["https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"]}],"documents":[{"id":119283,"url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","title":"Adobe Premiere APSB26-101","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}