{"id":"CVE-2026-48402","kind":"vulnerability","aliases":["CVE-2026-48402"],"related":[],"title":"Adobe Premiere Pro: untrusted search path lets a malicious file run code","description":"Premiere Pro is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Premiere Pro loads a component from an untrusted search path. A victim who opens a malicious file can have arbitrary code run in the context of their user account.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Premiere","fixed":["26.5.3"],"affected":"<= 26.5.2","ecosystem":"vendor"},{"name":"Adobe Premiere 25.x","fixed":["27.0"],"affected":"<= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","desktop","macos","other","premiere-pro","user-interaction","windows"],"not_affected_if":["no-untrusted-files","premiere-26.5.3-or-later","premiere-27.0-or-later"],"how_to_check":"Open Premiere > Help > About Premiere. Vulnerable if version is 26.5.2 or earlier, or 25.6.6 or earlier (Windows and macOS); fixed in 26.5.3 and 27.0.","fix":"Update Adobe Premiere to 26.5.3 (26.x line) or 27.0 via Creative Cloud / Download Center","status":"open","published_at":"2026-11-10T21:19:30+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:47:54+00:00","updated_at":"2026-11-10T21:50:00+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:47:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Premiere Pro: untrusted search path lets a malicious file run code","impact":"high","summary":"Adobe Premiere Pro loads a component from an untrusted search path. A victim who opens a malicious file can have arbitrary code run in the context of their user account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["premiere-pro","windows","macos","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs as the logged-in user on the workstation","analyst_note":"Find the affected Premiere Pro versions and Adobe's fixed build from the Adobe security bulletin for this CVE, and confirm the platforms.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run Adobe Premiere Pro on workstations, especially where users open project or media files from untrusted sources. The sources do not name affected versions or a configuration that limits exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":4553,"output_tokens":408,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Premiere Pro versions and Adobe's fixed build from the Adobe security bulletin for this CVE, and confirm the platforms.","search":"'-2026':14A,17A '-48402':15A,18A '25':23A 'account':65B 'adob':1A,25B,36B 'adobe':19A,21A 'affect':69C 'arbitrari':56B,80C,98C 'attack':91C 'code':12A,57B,81C,99C 'compon':41B 'context':61B,85C 'could':77C,92C 'current':88C 'cve':13A,16A 'desktop':26B 'execut':82C,97C 'exploit':93C,100C 'file':10A,53B,115C 'interact':34B,106C 'issu':103C 'let':7A 'load':39B 'maco':27B 'malici':9A,52B,114C 'must':111C 'open':50B,112C 'path':6A,46B,74C 'premier':2A,30B,37B,66C 'premiere':20A,22A 'premiere-pro':29B 'pro':3A,31B,38B,67C 'requir':104C 'result':78C 'run':11A,58B 'search':5A,45B,73C 'untrust':4A,44B,72C 'user':33B,64B,89C,105C 'user-interact':32B 'victim':48B,110C 'vulner':75C,95C 'window':35B 'x':24A","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Premiere on Windows or macOS at 26.5.2 or earlier, or 25.6.6 or earlier. Exploitation needs the user to open a malicious file that makes Premiere load a component from an untrusted search path, running code as that user. Editors who receive files from outside should look first; teams not using Premiere can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:50:00Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2863},"products":{"at":"2026-11-10T21:50:00Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2863},"how_to_check":{"at":"2026-11-10T21:50:00Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2863},"who_affected":{"at":"2026-11-10T21:50:00Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2863}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adobepremiere","adobepremiere25x","premiere","premiere25x"],"ptokens":["25","adobe","premiere"],"labels":["adobe","desktop","high","macos","other","premierepro","userinteraction","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-48402':15A,18A '25':23A 'adob':1A 'adobe':19A,21A 'code':12A 'cve':13A,16A 'file':10A 'let':7A 'malici':9A 'path':6A 'premier':2A 'premiere':20A,22A 'pro':3A 'run':11A 'search':5A 'untrust':4A 'x':24A","search_b":"'account':65B 'adob':25B,36B 'arbitrari':56B 'code':57B 'compon':41B 'context':61B 'desktop':26B 'file':53B 'interact':34B 'load':39B 'maco':27B 'malici':52B 'open':50B 'path':46B 'premier':30B,37B 'premiere-pro':29B 'pro':31B,38B 'run':58B 'search':45B 'untrust':44B 'user':33B,64B 'user-interact':32B 'victim':48B 'window':35B","search_c":"'affect':69C 'arbitrari':80C,98C 'attack':91C 'code':81C,99C 'context':85C 'could':77C,92C 'current':88C 'execut':82C,97C 'exploit':93C,100C 'file':115C 'interact':106C 'issu':103C 'malici':114C 'must':111C 'open':112C 'path':74C 'premier':66C 'pro':67C 'requir':104C 'result':78C 'search':73C 'untrust':72C 'user':89C,105C 'victim':110C 'vulner':75C,95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48402","severity":null,"published_at":"2026-11-10T21:19:30+00:00","modified_at":"2026-11-10T21:19:30+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-48402:2863","url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","severity":null,"published_at":"2026-11-10T21:50:00+00:00","modified_at":"2026-11-10T21:50:00+00:00","first_seen_at":"2026-11-10T21:50:00+00:00","fetched_at":"2026-11-10T21:50:00+00:00","note":"Read Adobe APSB26-101 (Nov 10 2026, priority 3, no known exploitation): affected 26.5.2 and earlier, 25.6.6 and earlier, Windows+macOS; fixed 26.5.3 and 27.0. Untrusted search path CWE-426, reported by Jony. No PoC/chatter checked; no repo-readable check.","cites":["https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"]}],"documents":[{"id":119283,"url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","title":"Adobe Premiere APSB26-101","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}