{"id":"CVE-2026-113551","kind":"vulnerability","aliases":["CVE-2026-113551"],"related":[],"title":"Adobe Audition: design flaw lets a local low-privileged user gain elevated access (fixed in 27.0 / 26.5.3)","description":"Audition is affected by a Violation of Secure Design Principles vulnerability that could result in privilege escalation. A low-privileged attacker could leverage this vulnerability to gain elevated access. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe Audition has a Violation of Secure Design Principles flaw (CWE-657, CVSS 8.7) that lets a local low-privileged user gain elevated access, with no user interaction and a changed scope. Adobe fixed it in APSB26-102 on Nov 10 2026 and is not aware of exploitation.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Audition","fixed":["27.0","26.5.3"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-audition","desktop","macos","other","privilege-escalation","windows"],"not_affected_if":[],"how_to_check":"In Audition: Help > About Audition. Exposed if version is 26.5 or earlier, or 25.6.6 or earlier (Windows or macOS). Fixed: 27.0 or 26.5.3.","fix":"Update Adobe Audition to 27.0 (or 26.5.3 on the 26.5 line) via Creative Cloud desktop app / Adobe Download Center. Adobe lists 25.6.6 and earlier as affected but names no fixed 25.6.x build in this bulletin.","status":"open","published_at":"2026-11-10T21:18:48+00:00","first_seen_at":"2026-11-10T21:46:11+00:00","triaged_at":"2026-11-10T21:47:44+00:00","updated_at":"2026-11-10T21:56:30+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:47:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Audition: insecure design flaw lets low-privileged users escalate privileges","impact":"high","summary":"Adobe Audition has a design flaw that lets a low-privileged account gain elevated access. The sources do not say which platform or version is affected, and an attacker needs only a local low-privileged account, with no user interaction required.","audience":"everyone","category":"other","nicknames":[],"who_cares":["adobe-audition","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privileged user gains elevated access on the machine","analyst_note":"Confirm affected Audition versions and vendor fix from Adobe's security bulletin; NVD entry alone gives no version ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":4537,"output_tokens":360,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Audition versions and vendor fix from Adobe's security bulletin; NVD entry alone gives no version ranges.","search":"'-102':75B '-113551':21A,24A '-2026':20A,23A '-657':48B '10':78B '2026':79B '26.5.3':18A '27.0':17A '8.7':50B 'access':14A,61B,115C 'adob':1A,28B,37B,70B 'adobe':25A 'adobe-audit':27B 'affect':88C 'apsb26':74B 'attack':107C 'audit':2A,29B,38B,86C 'audition':26A 'awar':83B 'chang':68B,127C 'could':98C,108C 'cve':19A,22A 'cvss':49B 'cwe':47B 'design':3A,44B,94C 'desktop':30B 'elev':13A,60B,114C 'escal':35B,102C 'exploit':85B,116C 'fix':15A,71B 'flaw':4A,46B 'gain':12A,59B,113C 'interact':65B,124C 'issu':119C 'let':5A,52B 'leverag':109C 'local':7A,54B 'low':9A,56B,105C 'low-privileg':8A,55B,104C 'maco':31B 'nov':77B 'principl':45B,95C 'privileg':10A,34B,57B,101C,106C 'privilege-escal':33B 'requir':122C 'result':99C 'scope':69B,125C 'secur':43B,93C 'user':11A,58B,64B,123C 'violat':41B,91C 'vulner':96C,111C 'window':36B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Audition 26.5 or earlier, or 25.6.6 or earlier, on Windows or macOS. The attacker needs local access with a low-privileged account, so shared or multi-user workstations matter most. Machines without Audition installed, or already on 27.0 or 26.5.3, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:56:30Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2889},"products":{"at":"2026-11-10T21:56:30Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2889},"how_to_check":{"at":"2026-11-10T21:56:30Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2889},"who_affected":{"at":"2026-11-10T21:56:30Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2889}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeaudition","audition"],"ptokens":["adobe","audition"],"labels":["adobeaudition","desktop","high","macos","other","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-113551':21A,24A '-2026':20A,23A '26.5.3':18A '27.0':17A 'access':14A 'adob':1A 'adobe':25A 'audit':2A 'audition':26A 'cve':19A,22A 'design':3A 'elev':13A 'fix':15A 'flaw':4A 'gain':12A 'let':5A 'local':7A 'low':9A 'low-privileg':8A 'privileg':10A 'user':11A","search_b":"'-102':75B '-657':48B '10':78B '2026':79B '8.7':50B 'access':61B 'adob':28B,37B,70B 'adobe-audit':27B 'apsb26':74B 'audit':29B,38B 'awar':83B 'chang':68B 'cvss':49B 'cwe':47B 'design':44B 'desktop':30B 'elev':60B 'escal':35B 'exploit':85B 'fix':71B 'flaw':46B 'gain':59B 'interact':65B 'let':52B 'local':54B 'low':56B 'low-privileg':55B 'maco':31B 'nov':77B 'principl':45B 'privileg':34B,57B 'privilege-escal':33B 'scope':69B 'secur':43B 'user':58B,64B 'violat':41B 'window':36B","search_c":"'access':115C 'affect':88C 'attack':107C 'audit':86C 'chang':127C 'could':98C,108C 'design':94C 'elev':114C 'escal':102C 'exploit':116C 'gain':113C 'interact':124C 'issu':119C 'leverag':109C 'low':105C 'low-privileg':104C 'principl':95C 'privileg':101C,106C 'requir':122C 'result':99C 'scope':125C 'secur':93C 'user':123C 'violat':91C 'vulner':96C,111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113551","severity":null,"published_at":"2026-11-10T21:18:48+00:00","modified_at":"2026-11-10T21:18:48+00:00","first_seen_at":"2026-11-10T21:46:11+00:00","fetched_at":"2026-11-10T21:46:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113551:2889","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","severity":null,"published_at":"2026-11-10T21:56:30+00:00","modified_at":"2026-11-10T21:56:30+00:00","first_seen_at":"2026-11-10T21:56:30+00:00","fetched_at":"2026-11-10T21:56:30+00:00","note":"Read Adobe APSB26-102 (Nov 10 2026): affected 26.5 and earlier / 25.6.6 and earlier, fixed 27.0 / 26.5.3, Windows+macOS, no known exploits. No repo-readable check (desktop app).","cites":["https://www.adobe.com/trust/security/products/audition/apsb26-102.html"]}],"documents":[{"id":119325,"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","title":"Adobe APSB26-102: Security update available for Adobe Audition","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}