{"id":"CVE-2026-113539","kind":"vulnerability","aliases":["CVE-2026-113539"],"related":[],"title":"Adobe Media Encoder: malicious file crashes the app via null pointer","description":"Media Encoder is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Media Encoder has a null pointer dereference that crashes the application when it processes a malicious file. An attacker gets a denial-of-service, and a victim must open the crafted file for it to trigger.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-media-encoder","creative-workstations","other"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T21:18:46+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:49:52+00:00","updated_at":"2026-11-10T21:49:52+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T21:49:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Media Encoder: malicious file crashes the app via null pointer","impact":"low","summary":"Adobe Media Encoder has a null pointer dereference that crashes the application when it processes a malicious file. An attacker gets a denial-of-service, and a victim must open the crafted file for it to trigger.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-media-encoder","creative-workstations"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes and stops, causing denial of service","analyst_note":"Find the affected and fixed Media Encoder versions in Adobe's security bulletin for CVE-2026-113539; the NVD entry gives none.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run Adobe Media Encoder on workstations or render servers and open media files from untrusted sources. The sources do not name affected versions, so the exact range is unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":4551,"output_tokens":421,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113539':14A,17A '-2026':13A,16A 'adob':1A,19B,25B 'adobe-media-encod':18B 'affect':66C 'app':8A 'applic':36B,78C,92C 'attack':44B,84C 'condit':100C 'could':74C,85C 'craft':57B 'crash':6A,34B,90C 'creativ':23B 'creative-workst':22B 'cve':12A,15A 'denial':48B,80C,97C 'denial-of-servic':47B,79C,96C 'derefer':32B,71C 'encod':3A,21B,27B,64C 'exploit':86C,101C 'file':5A,42B,58B,116C 'get':45B 'interact':107C 'issu':104C 'lead':93C 'malici':4A,41B,115C 'media':2A,20B,26B,63C 'must':54B,112C 'null':10A,30B,69C 'open':55B,113C 'pointer':11A,31B,70C 'process':39B 'requir':105C 'result':75C 'servic':50B,82C,99C 'trigger':62B 'user':106C 'via':9A 'victim':53B,111C 'vulner':72C,88C 'workstat':24B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Adobe Media Encoder on workstations or render servers and open media files from untrusted sources. The sources do not name affected versions, so the exact range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobemediaencoder","creativeworkstations","medium","other"],"campaign_type":null,"search_a":"'-113539':14A,17A '-2026':13A,16A 'adob':1A 'app':8A 'crash':6A 'cve':12A,15A 'encod':3A 'file':5A 'malici':4A 'media':2A 'null':10A 'pointer':11A 'via':9A","search_b":"'adob':19B,25B 'adobe-media-encod':18B 'applic':36B 'attack':44B 'craft':57B 'crash':34B 'creativ':23B 'creative-workst':22B 'denial':48B 'denial-of-servic':47B 'derefer':32B 'encod':21B,27B 'file':42B,58B 'get':45B 'malici':41B 'media':20B,26B 'must':54B 'null':30B 'open':55B 'pointer':31B 'process':39B 'servic':50B 'trigger':62B 'victim':53B 'workstat':24B","search_c":"'affect':66C 'applic':78C,92C 'attack':84C 'condit':100C 'could':74C,85C 'crash':90C 'denial':80C,97C 'denial-of-servic':79C,96C 'derefer':71C 'encod':64C 'exploit':86C,101C 'file':116C 'interact':107C 'issu':104C 'lead':93C 'malici':115C 'media':63C 'must':112C 'null':69C 'open':113C 'pointer':70C 'requir':105C 'result':75C 'servic':82C,99C 'user':106C 'victim':111C 'vulner':72C,88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113539","severity":null,"published_at":"2026-11-10T21:18:46+00:00","modified_at":"2026-11-10T21:18:46+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}