{"id":"CVE-2026-110088","kind":"vulnerability","aliases":["CVE-2026-110088"],"related":[],"title":"Adobe Premiere Pro: buffer overflow lets a malicious file run code","description":"Premiere Pro is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Premiere Pro has a buffer overflow that an attacker can trigger with a crafted file. A victim who opens the malicious file lets the attacker run code as the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Premiere","fixed":["26.5.3"],"affected":"<= 26.5.2","ecosystem":"vendor"},{"name":"Adobe Premiere (25.6 branch)","fixed":["27.0"],"affected":"<= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","macos","other","premiere-pro","user-interaction","windows"],"not_affected_if":["premiere-26.5.3-or-later","premiere-pro-not-installed"],"how_to_check":"Open Premiere > About (macOS: Premiere menu > About; Windows: Help > About). Exposed if version is 26.5.2 or earlier, or 25.6.6 or earlier, on Windows or macOS. Fixed: 26.5.3 or 27.0.","fix":"Update Adobe Premiere to 26.5.3 (26.x branch) or 27.0 (also the move for 25.6.x), via Creative Cloud / Download Center.","status":"open","published_at":"2026-11-10T21:18:19+00:00","first_seen_at":"2026-11-10T21:46:09+00:00","triaged_at":"2026-11-10T21:48:17+00:00","updated_at":"2026-11-10T22:02:24+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Premiere Pro: buffer overflow lets a malicious file run code","impact":"high","summary":"Adobe Premiere Pro has a buffer overflow that an attacker can trigger with a crafted file. A victim who opens the malicious file lets the attacker run code as the current user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["premiere-pro","adobe","windows","macos"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"arbitrary code runs as the current user on the machine","analyst_note":"Find the Adobe security bulletin for this CVE to get affected and fixed Premiere Pro versions and the platforms covered.","how_to_check":"- Check the installed Premiere Pro version in the application's About or Help menu.\n- Compare it against the fixed versions named by the vendor advisory; the sources do not list them.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["premiere-pro-not-installed"],"who_is_affected":"Teams that run Adobe Premiere Pro on workstations and open project or media files from outside sources. The sources do not list affected version ranges. Users who do not run Premiere Pro can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4552,"output_tokens":477,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Adobe security bulletin for this CVE to get affected and fixed Premiere Pro versions and the platforms covered.","search":"'-110088':14A,17A '-2026':13A,16A '25.6':22A 'adob':1A,24B,34B 'adobe':18A,20A 'affect':69C 'arbitrari':79C,97C 'attack':43B,59B,90C 'branch':23A 'buffer':4A,39B,72C 'code':11A,61B,80C,98C 'context':84C 'could':76C,91C 'craft':48B 'current':64B,87C 'cve':12A,15A 'execut':81C,96C 'exploit':92C,99C 'file':9A,49B,56B,114C 'interact':32B,105C 'issu':102C 'let':6A,57B 'maco':25B 'malici':8A,55B,113C 'must':110C 'open':53B,111C 'overflow':5A,40B,73C 'premier':2A,28B,35B,66C 'premiere':19A,21A 'premiere-pro':27B 'pro':3A,29B,36B,67C 'requir':103C 'result':77C 'run':10A,60B 'trigger':45B 'user':31B,65B,88C,104C 'user-interact':30B 'victim':51B,109C 'vulner':74C,94C 'window':33B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Premiere on Windows or macOS at 26.5.2 or earlier, or 25.6.6 or earlier. Exploitation needs a user to open a crafted file, and code runs as that user (local attack vector). Adobe is not aware of exploitation in the wild. Teams without Premiere installed can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:02:24Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2909},"products":{"at":"2026-11-10T22:02:24Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2909},"how_to_check":{"at":"2026-11-10T22:02:24Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2909},"who_affected":{"at":"2026-11-10T22:02:24Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2909}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobepremiere","adobepremiere256branch","premiere","premiere256branch"],"ptokens":["25","adobe","branch","premiere"],"labels":["adobe","high","macos","other","premierepro","userinteraction","windows"],"campaign_type":null,"search_a":"'-110088':14A,17A '-2026':13A,16A '25.6':22A 'adob':1A 'adobe':18A,20A 'branch':23A 'buffer':4A 'code':11A 'cve':12A,15A 'file':9A 'let':6A 'malici':8A 'overflow':5A 'premier':2A 'premiere':19A,21A 'pro':3A 'run':10A","search_b":"'adob':24B,34B 'attack':43B,59B 'buffer':39B 'code':61B 'craft':48B 'current':64B 'file':49B,56B 'interact':32B 'let':57B 'maco':25B 'malici':55B 'open':53B 'overflow':40B 'premier':28B,35B 'premiere-pro':27B 'pro':29B,36B 'run':60B 'trigger':45B 'user':31B,65B 'user-interact':30B 'victim':51B 'window':33B","search_c":"'affect':69C 'arbitrari':79C,97C 'attack':90C 'buffer':72C 'code':80C,98C 'context':84C 'could':76C,91C 'current':87C 'execut':81C,96C 'exploit':92C,99C 'file':114C 'interact':105C 'issu':102C 'malici':113C 'must':110C 'open':111C 'overflow':73C 'premier':66C 'pro':67C 'requir':103C 'result':77C 'user':88C,104C 'victim':109C 'vulner':74C,94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110088","severity":null,"published_at":"2026-11-10T21:18:19+00:00","modified_at":"2026-11-10T21:18:19+00:00","first_seen_at":"2026-11-10T21:46:09+00:00","fetched_at":"2026-11-10T21:46:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110088:2909","url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","severity":null,"published_at":"2026-11-10T22:02:24+00:00","modified_at":"2026-11-10T22:02:24+00:00","first_seen_at":"2026-11-10T22:02:24+00:00","fetched_at":"2026-11-10T22:02:24+00:00","note":"Read Adobe APSB26-101 (Nov 10 2026): affected Premiere <=26.5.2 and <=25.6.6, fixed 26.5.3 / 27.0, Win+macOS, no known exploitation. Fix path for 25.6.x branch not stated beyond 27.0.","cites":["https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"]}],"documents":[{"id":119283,"url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","title":"Adobe Premiere APSB26-101","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}