{"id":"CVE-2026-113563","kind":"vulnerability","aliases":["CVE-2026-113563"],"related":[],"title":"Adobe Audition: opening a malicious file runs arbitrary code as the user","description":"Audition is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","summary":"Adobe Audition has a Violation of Secure Design Principles flaw (CWE-657, CVSS 8.6) that can lead to arbitrary code execution as the current user when the victim opens a crafted file. Adobe's bulletin APSB26-102 says it is not aware of exploits in the wild. It does not name the file types that trigger it.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Audition","fixed":["26.5.3","27.0"],"affected":">= 26.0, <= 26.5; <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-audition","macos","other","user-interaction","windows"],"not_affected_if":["audition-not-installed"],"how_to_check":"In Audition open Help > About Audition (or check Creative Cloud desktop). Exposed if the version is 26.5 or earlier on the 26.x line, or 25.6.6 or earlier on the 25.x line.","fix":"Update to Adobe Audition 27.0, or 26.5.3 if staying on the 26.x line, via Creative Cloud or the Download Center.","status":"open","published_at":"2026-11-10T21:18:50+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","triaged_at":"2026-11-10T21:47:48+00:00","updated_at":"2026-11-10T21:54:38+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T21:47:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Audition: opening a malicious file runs arbitrary code as the user","impact":"high","summary":"Adobe Audition, an audio editing application, contains a secure design flaw that lets a malicious file run arbitrary code in the context of the current user. An attacker gets code execution on the victim's machine once the victim opens the crafted file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-audition","windows","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the logged-in user on the workstation","analyst_note":"Check Adobe's security bulletin for affected Audition versions, the fixed release and the file types that trigger the flaw; the NVD entry alone gives no versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["audition-not-installed"],"who_is_affected":"Anyone who runs Adobe Audition on a workstation and opens audio project or media files from untrusted sources is in scope. The sources do not list affected Audition versions or name a fixed release. Teams that do not use Audition can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4555,"output_tokens":454,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for affected Audition versions, the fixed release and the file types that trigger the flaw; the NVD entry alone gives no versions.","search":"'-102':66B '-113563':15A,18A '-2026':14A,17A '-657':41B '8.6':43B 'adob':1A,22B,30B,62B 'adobe':19A 'adobe-audit':21B 'affect':88C 'apsb26':65B 'arbitrari':8A,48B,101C,119C 'attack':112C 'audit':2A,23B,31B,86C 'audition':20A 'awar':71B 'bulletin':64B 'chang':139C 'code':9A,49B,102C,120C 'context':106C 'could':98C,113C 'craft':60B 'current':53B,109C 'cve':13A,16A 'cvss':42B 'cwe':40B 'design':37B,94C 'execut':50B,103C,118C 'exploit':73B,114C,121C 'file':6A,61B,82B,136C 'flaw':39B 'interact':28B,127C 'issu':124C 'lead':46B 'maco':24B 'malici':5A,135C 'must':132C 'name':80B 'open':3A,58B,133C 'principl':38B,95C 'requir':125C 'result':99C 'run':7A 'say':67B 'scope':137C 'secur':36B,93C 'trigger':85B 'type':83B 'user':12A,27B,54B,110C,126C 'user-interact':26B 'victim':57B,131C 'violat':34B,91C 'vulner':96C,116C 'wild':76B 'window':29B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Audition on Windows or macOS at 26.5 or earlier, or 25.6.6 or earlier. The attacker needs the user to open a crafted file, so editors who receive audio or project files from outsiders are most at risk. Teams that do not have Audition installed can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:54:38Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2882},"products":{"at":"2026-11-10T21:54:38Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2882},"who_affected":{"at":"2026-11-10T21:54:38Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2882}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["adobeaudition","audition"],"ptokens":["adobe","audition"],"labels":["adobeaudition","high","macos","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-113563':15A,18A '-2026':14A,17A 'adob':1A 'adobe':19A 'arbitrari':8A 'audit':2A 'audition':20A 'code':9A 'cve':13A,16A 'file':6A 'malici':5A 'open':3A 'run':7A 'user':12A","search_b":"'-102':66B '-657':41B '8.6':43B 'adob':22B,30B,62B 'adobe-audit':21B 'apsb26':65B 'arbitrari':48B 'audit':23B,31B 'awar':71B 'bulletin':64B 'code':49B 'craft':60B 'current':53B 'cvss':42B 'cwe':40B 'design':37B 'execut':50B 'exploit':73B 'file':61B,82B 'flaw':39B 'interact':28B 'lead':46B 'maco':24B 'name':80B 'open':58B 'principl':38B 'say':67B 'secur':36B 'trigger':85B 'type':83B 'user':27B,54B 'user-interact':26B 'victim':57B 'violat':34B 'wild':76B 'window':29B","search_c":"'affect':88C 'arbitrari':101C,119C 'attack':112C 'audit':86C 'chang':139C 'code':102C,120C 'context':106C 'could':98C,113C 'current':109C 'design':94C 'execut':103C,118C 'exploit':114C,121C 'file':136C 'interact':127C 'issu':124C 'malici':135C 'must':132C 'open':133C 'principl':95C 'requir':125C 'result':99C 'scope':137C 'secur':93C 'user':110C,126C 'victim':131C 'violat':91C 'vulner':96C,116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113563","severity":null,"published_at":"2026-11-10T21:18:50+00:00","modified_at":"2026-11-10T21:18:50+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","fetched_at":"2026-11-10T21:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113563:2882","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","severity":null,"published_at":"2026-11-10T21:54:38+00:00","modified_at":"2026-11-10T21:54:38+00:00","first_seen_at":"2026-11-10T21:54:38+00:00","fetched_at":"2026-11-10T21:54:38+00:00","note":"Read Adobe APSB26-102 (Nov 10 2026): affected 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 / 26.5.3. No exploitation known per Adobe; file types not stated.","cites":["https://www.adobe.com/trust/security/products/audition/apsb26-102.html"]}],"documents":[{"id":119325,"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","title":"Adobe APSB26-102: Security update available for Adobe Audition","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}