---
id: "CVE-2026-113560"
page: "https://infrastack.ai/live/CVE-2026-113560"
kind: "vulnerability"
aliases: ["CVE-2026-113560"]
title: "Adobe Audition: malicious file opens let attacker run code as user"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Adobe Audition", "fixed": ["26.5.3", "27.0"], "affected": "<= 26.5, <= 25.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-audition", "desktop", "macos", "other", "windows"]
not_affected_if: ["audition-27.0-or-26.5.3", "no-audition-installed"]
published_at: "2026-11-10T21:18:49+00:00"
first_seen_at: "2026-11-10T21:46:13+00:00"
updated_at: "2026-11-10T21:55:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113560", "first_seen_at": "2026-11-10T21:46:13+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/audition/apsb26-102.html", "first_seen_at": "2026-11-10T21:55:39+00:00", "cites": ["https://www.adobe.com/trust/security/products/audition/apsb26-102.html"]}]
exploit_sources: []
---

# Adobe Audition: malicious file opens let attacker run code as user

Link for people: https://infrastack.ai/live/CVE-2026-113560 (this .md is for agents)

Adobe Audition has an incorrect authorization flaw that can let an attacker run arbitrary code in the context of the current user. Exploitation requires the victim to open a malicious file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Audition affected <= 26.5, <= 25.6.6 fixed 26.5.3, 27.0

## How to check

Open Audition and check Help > About Adobe Audition. You are affected if the version is 26.5 or earlier, or 25.6.6 or earlier. Fixed builds are 26.5.3 and 27.0. In Creative Cloud desktop, check the Apps tab for updates.

## Fix

Update Adobe Audition to 27.0, or to 26.5.3 if on the 26.x line (Windows and macOS), per Adobe APSB26-102. The 25.6.x line is listed as affected through 25.6.6, and the bulletin names no fixed 25.x build, so move to 26.5.3 or 27.0.

## Timeline

- 2026-11-10T21:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113560
- 2026-11-10T21:55:39+00:00 analyst https://www.adobe.com/trust/security/products/audition/apsb26-102.html — Read Adobe APSB26-102 (Nov 10 2026): affected 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 and 26.5.3. No exploitation known. No repo-readable check (desktop app).

## Documents

- [advisory] Adobe APSB26-102: Security update available for Adobe Audition https://www.adobe.com/trust/security/products/audition/apsb26-102.html

## From the sources

Audition is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_