{"id":"CVE-2026-113567","kind":"vulnerability","aliases":["CVE-2026-113567"],"related":[],"title":"Adobe Audition: out-of-bounds write lets a malicious file run code","description":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Audition, an audio editing application, has an out-of-bounds write flaw. Opening a crafted file can let an attacker run code as the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Audition","fixed":["27.0","26.5.3"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-audition","desktop","macos","other","windows"],"not_affected_if":["audition-26.5.3-or-later","audition-27.0-or-later","no-audition-installed"],"how_to_check":"Open Audition > Help > About Audition. Affected: 26.5 and earlier, or 25.6.6 and earlier, on Windows or macOS. Not affected: 27.0 or 26.5.3 and later.","fix":"Update Adobe Audition to 27.0, or 26.5.3 on the 26.x line, via Download Center / Creative Cloud (APSB26-102). Adobe lists no fixed 25.x build; 25.6.6 and earlier are affected.","status":"open","published_at":"2026-11-10T21:18:50+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","triaged_at":"2026-11-10T21:48:00+00:00","updated_at":"2026-11-10T21:54:19+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Audition: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe Audition, an audio editing application, has an out-of-bounds write flaw. Opening a crafted file can let an attacker run code as the current user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-audition","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code as the logged-in user after opening a file","analyst_note":"Find the affected and fixed Audition versions and Adobe's bulletin (NVD link in sources does not list them).","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-audition-installed"],"who_is_affected":"Anyone who opens files in Adobe Audition on a desktop machine may be exposed, since the flaw is triggered by opening a malicious file. The sources do not list affected versions. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":4520,"output_tokens":397,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Audition versions and Adobe's bulletin (NVD link in sources does not list them).","search":"'-113567':16A,19A '-2026':15A,18A 'adob':1A,23B,29B 'adobe':20A 'adobe-audit':22B 'affect':59C 'applic':34B 'arbitrari':72C 'attack':50B 'audio':32B 'audit':2A,24B,30B,57C 'audition':21A 'bound':6A,40B,65C 'code':13A,52B,73C 'context':77C 'could':69C 'craft':45B 'current':55B,80C 'cve':14A,17A 'desktop':25B 'edit':33B 'execut':74C 'exploit':82C 'file':11A,46B,97C 'flaw':42B 'interact':88C 'issu':85C 'let':8A,48B 'maco':26B 'malici':10A,96C 'must':93C 'open':43B,94C 'out-of-bound':3A,37B,62C 'requir':86C 'result':70C 'run':12A,51B 'user':56B,81C,87C 'victim':92C 'vulner':67C 'window':28B 'write':7A,41B,66C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Audition on Windows or macOS at version 26.5 or earlier (or 25.6.6 or earlier) is exposed. The flaw is an out-of-bounds write triggered when the user opens a malicious file, running code as that user. Teams without Audition installed can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:54:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2880},"products":{"at":"2026-11-10T21:54:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2880},"how_to_check":{"at":"2026-11-10T21:54:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2880},"who_affected":{"at":"2026-11-10T21:54:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","run_id":2880}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeaudition","audition"],"ptokens":["adobe","audition"],"labels":["adobeaudition","desktop","high","macos","other","windows"],"campaign_type":null,"search_a":"'-113567':16A,19A '-2026':15A,18A 'adob':1A 'adobe':20A 'audit':2A 'audition':21A 'bound':6A 'code':13A 'cve':14A,17A 'file':11A 'let':8A 'malici':10A 'out-of-bound':3A 'run':12A 'write':7A","search_b":"'adob':23B,29B 'adobe-audit':22B 'applic':34B 'attack':50B 'audio':32B 'audit':24B,30B 'bound':40B 'code':52B 'craft':45B 'current':55B 'desktop':25B 'edit':33B 'file':46B 'flaw':42B 'let':48B 'maco':26B 'open':43B 'out-of-bound':37B 'run':51B 'user':56B 'window':28B 'write':41B","search_c":"'affect':59C 'arbitrari':72C 'audit':57C 'bound':65C 'code':73C 'context':77C 'could':69C 'current':80C 'execut':74C 'exploit':82C 'file':97C 'interact':88C 'issu':85C 'malici':96C 'must':93C 'open':94C 'out-of-bound':62C 'requir':86C 'result':70C 'user':81C,87C 'victim':92C 'vulner':67C 'write':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113567","severity":null,"published_at":"2026-11-10T21:18:50+00:00","modified_at":"2026-11-10T21:18:50+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","fetched_at":"2026-11-10T21:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113567:2880","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","severity":null,"published_at":"2026-11-10T21:54:19+00:00","modified_at":"2026-11-10T21:54:19+00:00","first_seen_at":"2026-11-10T21:54:19+00:00","fetched_at":"2026-11-10T21:54:19+00:00","note":"Found in Adobe APSB26-102 (Nov 10 2026): affected Audition 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 and 26.5.3. Adobe not aware of exploitation. No community search done (routine B).","cites":["https://www.adobe.com/trust/security/products/audition/apsb26-102.html"]}],"documents":[{"id":119325,"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html","title":"Adobe APSB26-102: Security update available for Adobe Audition","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}