{"id":"CVE-2026-113557","kind":"vulnerability","aliases":["CVE-2026-113557"],"related":[],"title":"Adobe Audition: malicious file opens let attackers run code as user","description":"Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","summary":"Adobe Audition has an improper input validation flaw that lets a crafted file run arbitrary code in the context of the current user. An attacker gets code execution on the victim's machine once the victim opens the malicious file.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Audition","fixed":["26.5.3","27.0"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-audition","macos","user-interaction","vendor","windows"],"not_affected_if":["audition-not-installed"],"how_to_check":"Open Help > About Adobe Audition (or check the version in Creative Cloud desktop). Exposed if the version is 26.5 or earlier on the 26.x line, or 25.6.6 or earlier. Fixed: 26.5.3 and 27.0.","fix":"Update Adobe Audition to 27.0, or to 26.5.3 if on the 26.x line (Creative Cloud / Download Center). 25.6.6 and earlier is listed as affected, but the bulletin names no fixed 25.x build, so move to 26.5.3 or 27.0.","status":"open","published_at":"2026-11-10T21:18:49+00:00","first_seen_at":"2026-11-10T21:46:11+00:00","triaged_at":"2026-11-10T21:47:50+00:00","updated_at":"2026-11-10T21:55:32+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-10T21:47:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Audition: malicious file opens let attackers run code as user","impact":"high","summary":"Adobe Audition has an improper input validation flaw that lets a crafted file run arbitrary code in the context of the current user. An attacker gets code execution on the victim's machine once the victim opens the malicious file.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-audition","windows","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the logged-in user on the machine","analyst_note":"Find the affected and fixed Audition versions in the Adobe security bulletin for this CVE; the NVD entry gives none.","how_to_check":"- Check the installed Audition version in Help > About Adobe Audition, or the version in the install folder name.\n- Compare it against the fixed version in the vendor advisory (unknown in the sources).","plain_action":"","product_name":"Adobe Audition","needs_analyst":true,"not_affected_if":["audition-not-installed"],"who_is_affected":"Teams that run Adobe Audition on workstations and open audio project or media files from outside sources are exposed. The sources do not list affected version ranges. Systems where Audition is not installed can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4550,"output_tokens":503,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Audition versions in the Adobe security bulletin for this CVE; the NVD entry gives none.","search":"'-113557':14A,17A '-2026':13A,16A 'adob':1A,21B,29B 'adobe':18A 'adobe-audit':20B 'affect':71C 'arbitrari':43B,82C,100C 'attack':7A,53B,93C 'audit':2A,22B,30B,69C 'audition':19A 'chang':120C 'code':9A,44B,55B,83C,101C 'context':47B,87C 'could':79C,94C 'craft':40B 'current':50B,90C 'cve':12A,15A 'execut':56B,84C,99C 'exploit':95C,102C 'file':4A,41B,68B,117C 'flaw':36B 'get':54B 'improp':33B,74C 'input':34B,75C 'interact':26B,108C 'issu':105C 'let':6A,38B 'machin':61B 'maco':23B 'malici':3A,67B,116C 'must':113C 'open':5A,65B,114C 'requir':106C 'result':80C 'run':8A,42B 'scope':118C 'user':11A,25B,51B,91C,107C 'user-interact':24B 'valid':35B,76C 'vendor':27B 'victim':59B,64B,112C 'vulner':77C,97C 'window':28B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Audition on Windows or macOS at 26.5 or earlier, or 25.6.6 or earlier, is affected. A crafted file opened by the user can run code as that user, so look at workstations that open audio or project files from outside sources. Machines without Audition can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:55:32Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2886},"products":{"at":"2026-11-10T21:55:32Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2886},"how_to_check":{"at":"2026-11-10T21:55:32Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2886},"who_affected":{"at":"2026-11-10T21:55:32Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2886}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeaudition","audition"],"ptokens":["adobe","audition"],"labels":["adobeaudition","high","macos","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-113557':14A,17A '-2026':13A,16A 'adob':1A 'adobe':18A 'attack':7A 'audit':2A 'audition':19A 'code':9A 'cve':12A,15A 'file':4A 'let':6A 'malici':3A 'open':5A 'run':8A 'user':11A","search_b":"'adob':21B,29B 'adobe-audit':20B 'arbitrari':43B 'attack':53B 'audit':22B,30B 'code':44B,55B 'context':47B 'craft':40B 'current':50B 'execut':56B 'file':41B,68B 'flaw':36B 'get':54B 'improp':33B 'input':34B 'interact':26B 'let':38B 'machin':61B 'maco':23B 'malici':67B 'open':65B 'run':42B 'user':25B,51B 'user-interact':24B 'valid':35B 'vendor':27B 'victim':59B,64B 'window':28B","search_c":"'affect':71C 'arbitrari':82C,100C 'attack':93C 'audit':69C 'chang':120C 'code':83C,101C 'context':87C 'could':79C,94C 'current':90C 'execut':84C,99C 'exploit':95C,102C 'file':117C 'improp':74C 'input':75C 'interact':108C 'issu':105C 'malici':116C 'must':113C 'open':114C 'requir':106C 'result':80C 'scope':118C 'user':91C,107C 'valid':76C 'victim':112C 'vulner':77C,97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113557","severity":null,"published_at":"2026-11-10T21:18:49+00:00","modified_at":"2026-11-10T21:18:49+00:00","first_seen_at":"2026-11-10T21:46:11+00:00","fetched_at":"2026-11-10T21:46:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113557:2886","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","severity":null,"published_at":"2026-11-10T21:55:32+00:00","modified_at":"2026-11-10T21:55:32+00:00","first_seen_at":"2026-11-10T21:55:32+00:00","fetched_at":"2026-11-10T21:55:32+00:00","note":"Adobe APSB26-102 (2026-11-10): affected 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 / 26.5.3. No exploitation known per Adobe.","cites":["https://www.adobe.com/trust/security/products/audition/apsb26-102.html"]}],"documents":[{"id":119325,"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","title":"Adobe APSB26-102: Security update available for Adobe Audition","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}