---
id: "CVE-2026-113557"
page: "https://infrastack.ai/live/CVE-2026-113557"
kind: "vulnerability"
aliases: ["CVE-2026-113557"]
title: "Adobe Audition: malicious file opens let attackers run code as user"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Audition", "fixed": ["26.5.3", "27.0"], "affected": "<= 26.5, <= 25.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-audition", "macos", "user-interaction", "vendor", "windows"]
not_affected_if: ["audition-not-installed"]
published_at: "2026-11-10T21:18:49+00:00"
first_seen_at: "2026-11-10T21:46:11+00:00"
updated_at: "2026-11-10T21:55:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113557", "first_seen_at": "2026-11-10T21:46:11+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/audition/apsb26-102.html", "first_seen_at": "2026-11-10T21:55:32+00:00", "cites": ["https://www.adobe.com/trust/security/products/audition/apsb26-102.html"]}]
exploit_sources: []
---

# Adobe Audition: malicious file opens let attackers run code as user

Link for people: https://infrastack.ai/live/CVE-2026-113557 (this .md is for agents)

Adobe Audition has an improper input validation flaw that lets a crafted file run arbitrary code in the context of the current user. An attacker gets code execution on the victim's machine once the victim opens the malicious file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Audition affected <= 26.5, <= 25.6.6 fixed 26.5.3, 27.0

## How to check

Open Help > About Adobe Audition (or check the version in Creative Cloud desktop). Exposed if the version is 26.5 or earlier on the 26.x line, or 25.6.6 or earlier. Fixed: 26.5.3 and 27.0.

## Fix

Update Adobe Audition to 27.0, or to 26.5.3 if on the 26.x line (Creative Cloud / Download Center). 25.6.6 and earlier is listed as affected, but the bulletin names no fixed 25.x build, so move to 26.5.3 or 27.0.

## Timeline

- 2026-11-10T21:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113557
- 2026-11-10T21:55:32+00:00 analyst https://www.adobe.com/trust/security/products/audition/apsb26-102.html — Adobe APSB26-102 (2026-11-10): affected 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 / 26.5.3. No exploitation known per Adobe.

## Documents

- [advisory] Adobe APSB26-102: Security update available for Adobe Audition https://www.adobe.com/trust/security/products/audition/apsb26-102.html

## From the sources

Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_