{"id":"CVE-2026-113553","kind":"vulnerability","aliases":["CVE-2026-113553"],"related":[],"title":"Adobe Audition: out-of-bounds write lets a malicious file run code (fixed in 27.0 and 26.5.3)","description":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Audition has an out-of-bounds write flaw that an attacker can trigger by getting a victim to open a crafted file. Successful exploitation can run arbitrary code in the context of the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Audition","fixed":["27.0","26.5.3"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-audition","macos","other","user-interaction","windows"],"not_affected_if":["no-audition-installed"],"how_to_check":"In Audition, open Help > About Audition. You are exposed if the version is 26.5 or earlier, or 25.6.6 or earlier. Fixed versions are 27.0 and 26.5.3.","fix":"Update Adobe Audition to 27.0, or to 26.5.3 if on the 26.x line, via the Creative Cloud desktop app (APSB26-102).","status":"open","published_at":"2026-11-10T21:18:49+00:00","first_seen_at":"2026-11-10T21:46:11+00:00","triaged_at":"2026-11-10T21:48:02+00:00","updated_at":"2026-11-10T21:56:32+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Audition: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe Audition has an out-of-bounds write flaw that an attacker can trigger by getting a victim to open a crafted file. Successful exploitation can run arbitrary code in the context of the current user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-audition","windows","macos"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary code runs as the current user after opening a file","analyst_note":"Confirm affected Audition versions and the fixed release from Adobe's security bulletin; the NVD entry gives no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-audition-installed"],"who_is_affected":"Teams that install Adobe Audition on workstations are exposed if users open files from untrusted sources. The sources do not list affected version ranges, so the exact versions are unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":4520,"output_tokens":414,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Audition versions and the fixed release from Adobe's security bulletin; the NVD entry gives no product ranges.","search":"'-113553':21A,24A '-2026':20A,23A '26.5.3':18A '27.0':16A 'adob':1A,28B,36B 'adobe':25A 'adobe-audit':27B 'affect':75C 'arbitrari':64B,88C 'attack':48B 'audit':2A,29B,37B,73C 'audition':26A 'bound':6A,43B,81C 'code':13A,65B,89C 'context':68B,93C 'could':85C 'craft':58B 'current':71B,96C 'cve':19A,22A 'execut':90C 'exploit':61B,98C 'file':11A,59B,113C 'fix':14A 'flaw':45B 'get':52B 'interact':34B,104C 'issu':101C 'let':8A 'maco':30B 'malici':10A,112C 'must':109C 'open':56B,110C 'out-of-bound':3A,40B,78C 'requir':102C 'result':86C 'run':12A,63B 'success':60B 'trigger':50B 'user':33B,72B,97C,103C 'user-interact':32B 'victim':54B,108C 'vulner':83C 'window':35B 'write':7A,44B,82C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Audition on Windows or macOS at 26.5 or earlier, or 25.6.6 or earlier. An attacker needs the user to open a crafted file, and code then runs with that user's rights. Teams that do not have Audition installed can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:56:32Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2888},"products":{"at":"2026-11-10T21:56:32Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2888},"how_to_check":{"at":"2026-11-10T21:56:32Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2888},"who_affected":{"at":"2026-11-10T21:56:32Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2888}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adobeaudition","audition"],"ptokens":["adobe","audition"],"labels":["adobeaudition","high","macos","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-113553':21A,24A '-2026':20A,23A '26.5.3':18A '27.0':16A 'adob':1A 'adobe':25A 'audit':2A 'audition':26A 'bound':6A 'code':13A 'cve':19A,22A 'file':11A 'fix':14A 'let':8A 'malici':10A 'out-of-bound':3A 'run':12A 'write':7A","search_b":"'adob':28B,36B 'adobe-audit':27B 'arbitrari':64B 'attack':48B 'audit':29B,37B 'bound':43B 'code':65B 'context':68B 'craft':58B 'current':71B 'exploit':61B 'file':59B 'flaw':45B 'get':52B 'interact':34B 'maco':30B 'open':56B 'out-of-bound':40B 'run':63B 'success':60B 'trigger':50B 'user':33B,72B 'user-interact':32B 'victim':54B 'window':35B 'write':44B","search_c":"'affect':75C 'arbitrari':88C 'audit':73C 'bound':81C 'code':89C 'context':93C 'could':85C 'current':96C 'execut':90C 'exploit':98C 'file':113C 'interact':104C 'issu':101C 'malici':112C 'must':109C 'open':110C 'out-of-bound':78C 'requir':102C 'result':86C 'user':97C,103C 'victim':108C 'vulner':83C 'write':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113553","severity":null,"published_at":"2026-11-10T21:18:49+00:00","modified_at":"2026-11-10T21:18:49+00:00","first_seen_at":"2026-11-10T21:46:11+00:00","fetched_at":"2026-11-10T21:46:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113553:2888","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","severity":null,"published_at":"2026-11-10T21:56:32+00:00","modified_at":"2026-11-10T21:56:32+00:00","first_seen_at":"2026-11-10T21:56:32+00:00","fetched_at":"2026-11-10T21:56:32+00:00","note":"Read Adobe APSB26-102 (Nov 10 2026): affected and fixed versions, no known exploitation. Not searched social.","cites":["https://www.adobe.com/trust/security/products/audition/apsb26-102.html"]}],"documents":[{"id":119325,"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","title":"Adobe APSB26-102: Security update available for Adobe Audition","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}