{"id":"CVE-2026-113562","kind":"vulnerability","aliases":["CVE-2026-113562"],"related":[],"title":"Adobe Audition: malicious file opens lead to arbitrary code execution","description":"Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","summary":"Adobe Audition has an improper input validation flaw (CWE-20) that lets a crafted file run code as the current user when the victim opens it. Fixed in Audition 27.0 and 26.5.3 (APSB26-102); Adobe is not aware of exploitation.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Audition","fixed":["27.0","26.5.3"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-audition","macos","other","user-interaction","windows"],"not_affected_if":["no-audition-installed"],"how_to_check":"Open Audition > About Audition (or Creative Cloud app) and read the version. Affected: 26.5 and earlier, or 25.6.6 and earlier, on Windows and macOS. Fixed: 27.0, 26.5.3.","fix":"Update Adobe Audition to 27.0 (or 26.5.3 on the 26.x line) via Creative Cloud desktop app; 25.6.x branch listed as affected up to 25.6.6, Adobe's bulletin lists fixed builds 27.0 and 26.5.3 only","status":"open","published_at":"2026-11-10T21:18:49+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","triaged_at":"2026-11-10T21:48:21+00:00","updated_at":"2026-11-10T21:55:36+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Audition: malicious file opens lead to arbitrary code execution","impact":"high","summary":"Adobe Audition has an input validation flaw that lets a crafted file run code as the current user. An attacker gets code execution on the victim's machine if the victim opens the malicious file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-audition","windows","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code as the current user","analyst_note":"Find the affected and fixed Audition versions from Adobe's security bulletin for this CVE; the NVD entry alone does not list them.","how_to_check":"- Check the installed Audition version in the application's About menu (unknown whether the sources name a specific affected range)\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-audition-installed"],"who_is_affected":"Users who run Adobe Audition and open files from untrusted sources. The sources do not list affected versions, so the exact range is unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4570,"output_tokens":429,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Audition versions from Adobe's security bulletin for this CVE; the NVD entry alone does not list them.","search":"'-102':61B '-113562':13A,16A '-20':37B '-2026':12A,15A '26.5.3':59B '27.0':57B 'adob':1A,20B,28B,62B 'adobe':17A 'adobe-audit':19B 'affect':70C 'apsb26':60B 'arbitrari':8A,81C,99C 'attack':92C,107C 'audit':2A,21B,29B,56B,68C 'audition':18A 'awar':65B 'beyond':105C 'chang':128C 'code':9A,44B,82C,100C 'condit':104C 'context':86C 'control':109C 'could':78C,93C 'craft':41B 'current':47B,89C 'cve':11A,14A 'cwe':36B 'depend':102C 'execut':10A,83C,98C 'exploit':67B,94C,101C,110C 'file':4A,42B,125C 'fix':54B 'flaw':35B 'improp':32B,73C 'input':33B,74C 'interact':26B,116C 'issu':113C 'lead':6A 'let':39B 'maco':22B 'malici':3A,124C 'must':121C 'open':5A,52B,122C 'requir':114C 'result':79C 'run':43B 'scope':126C 'user':25B,48B,90C,115C 'user-interact':24B 'valid':34B,75C 'victim':51B,120C 'vulner':76C,96C 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Users who run Adobe Audition and open files from untrusted sources. The sources do not list affected versions, so the exact range is unknown.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:55:36Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2883},"products":{"at":"2026-11-10T21:55:36Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2883},"how_to_check":{"at":"2026-11-10T21:55:36Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2883}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeaudition","audition"],"ptokens":["adobe","audition"],"labels":["adobeaudition","high","macos","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-113562':13A,16A '-2026':12A,15A 'adob':1A 'adobe':17A 'arbitrari':8A 'audit':2A 'audition':18A 'code':9A 'cve':11A,14A 'execut':10A 'file':4A 'lead':6A 'malici':3A 'open':5A","search_b":"'-102':61B '-20':37B '26.5.3':59B '27.0':57B 'adob':20B,28B,62B 'adobe-audit':19B 'apsb26':60B 'audit':21B,29B,56B 'awar':65B 'code':44B 'craft':41B 'current':47B 'cwe':36B 'exploit':67B 'file':42B 'fix':54B 'flaw':35B 'improp':32B 'input':33B 'interact':26B 'let':39B 'maco':22B 'open':52B 'run':43B 'user':25B,48B 'user-interact':24B 'valid':34B 'victim':51B 'window':27B","search_c":"'affect':70C 'arbitrari':81C,99C 'attack':92C,107C 'audit':68C 'beyond':105C 'chang':128C 'code':82C,100C 'condit':104C 'context':86C 'control':109C 'could':78C,93C 'current':89C 'depend':102C 'execut':83C,98C 'exploit':94C,101C,110C 'file':125C 'improp':73C 'input':74C 'interact':116C 'issu':113C 'malici':124C 'must':121C 'open':122C 'requir':114C 'result':79C 'scope':126C 'user':90C,115C 'valid':75C 'victim':120C 'vulner':76C,96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113562","severity":null,"published_at":"2026-11-10T21:18:49+00:00","modified_at":"2026-11-10T21:18:49+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","fetched_at":"2026-11-10T21:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113562:2883","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","severity":null,"published_at":"2026-11-10T21:55:36+00:00","modified_at":"2026-11-10T21:55:36+00:00","first_seen_at":"2026-11-10T21:55:36+00:00","fetched_at":"2026-11-10T21:55:36+00:00","note":"Read Adobe APSB26-102 (Nov 10 2026): affected 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 / 26.5.3. Adobe not aware of exploits. CWE-20, CVSS 7.7, needs user to open file.","cites":["https://www.adobe.com/trust/security/products/audition/apsb26-102.html","https://www.zerodayinitiative.com/blog/2026/11/10/the-november-2026-security-update-review"]}],"documents":[{"id":119325,"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","title":"Adobe APSB26-102: Security update available for Adobe Audition","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119332,"url":"https://www.zerodayinitiative.com/blog/2026/11/10/the-november-2026-security-update-review","title":"ZDI: November 2026 Security Update Review","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}