---
id: "CVE-2026-48402"
page: "https://infrastack.ai/live/CVE-2026-48402"
kind: "vulnerability"
aliases: ["CVE-2026-48402"]
title: "Adobe Premiere Pro: untrusted search path lets a malicious file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Adobe Premiere", "fixed": ["26.5.3"], "affected": "<= 26.5.2", "ecosystem": "vendor"}, {"name": "Adobe Premiere 25.x", "fixed": ["27.0"], "affected": "<= 25.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe", "desktop", "macos", "other", "premiere-pro", "user-interaction", "windows"]
not_affected_if: ["no-untrusted-files", "premiere-26.5.3-or-later", "premiere-27.0-or-later"]
published_at: "2026-11-10T21:19:30+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:50:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48402", "first_seen_at": "2026-11-10T21:46:15+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/premiere/apsb26-101.html", "first_seen_at": "2026-11-10T21:50:00+00:00", "cites": ["https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"]}]
exploit_sources: []
---

# Adobe Premiere Pro: untrusted search path lets a malicious file run code

Link for people: https://infrastack.ai/live/CVE-2026-48402 (this .md is for agents)

Adobe Premiere Pro loads a component from an untrusted search path. A victim who opens a malicious file can have arbitrary code run in the context of their user account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Premiere affected <= 26.5.2 fixed 26.5.3
- vendor:Adobe Premiere 25.x affected <= 25.6.6 fixed 27.0

## How to check

Open Premiere > Help > About Premiere. Vulnerable if version is 26.5.2 or earlier, or 25.6.6 or earlier (Windows and macOS); fixed in 26.5.3 and 27.0.

## Fix

Update Adobe Premiere to 26.5.3 (26.x line) or 27.0 via Creative Cloud / Download Center

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-48402
- 2026-11-10T21:50:00+00:00 analyst https://www.adobe.com/trust/security/products/premiere/apsb26-101.html — Read Adobe APSB26-101 (Nov 10 2026, priority 3, no known exploitation): affected 26.5.2 and earlier, 25.6.6 and earlier, Windows+macOS; fixed 26.5.3 and 27.0. Untrusted search path CWE-426, reported by Jony. No PoC/chatter checked; no repo-readable check.

## Documents

- [advisory] Adobe Premiere APSB26-101 https://www.adobe.com/trust/security/products/premiere/apsb26-101.html

## From the sources

Premiere Pro is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_