{"id":"CVE-2026-82002","kind":"vulnerability","aliases":["CVE-2026-82002"],"related":[],"title":"Adobe Media Encoder: malicious file can run code as current user","description":"Media Encoder is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","summary":"Adobe Media Encoder has an incorrect authorization flaw. Opening a malicious file can run arbitrary code in the context of the current user.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Media Encoder","fixed":["27.0","26.5.3"],"affected":"<= 26.5.2; <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-media-encoder","desktop","macos","other","windows"],"not_affected_if":["media-encoder-not-installed"],"how_to_check":"In Media Encoder open Help > About Media Encoder (or check Creative Cloud desktop app). Exposed if version is 26.5.2 or earlier, or 25.6.6 or earlier.","fix":"Update Adobe Media Encoder to 27.0, or 26.5.3 if on the 26.x line (Windows and macOS, via Download Center). The bulletin gives no fixed version for the 25.x line.","status":"open","published_at":"2026-11-10T21:20:11+00:00","first_seen_at":"2026-11-10T21:46:16+00:00","triaged_at":"2026-11-10T21:48:20+00:00","updated_at":"2026-11-10T21:49:14+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Media Encoder: malicious file can run code as current user","impact":"high","summary":"Adobe Media Encoder has an incorrect authorization flaw. Opening a malicious file can run arbitrary code in the context of the current user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-media-encoder","windows","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the current user after opening a malicious file","analyst_note":"Find the Adobe security bulletin for affected and fixed Media Encoder versions via the NVD entry; sources give no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["media-encoder-not-installed"],"who_is_affected":"Teams that install Adobe Media Encoder on workstations or render machines are exposed when a user opens a crafted file. The sources do not list affected or fixed versions. Systems without Media Encoder installed can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4553,"output_tokens":413,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Adobe security bulletin for affected and fixed Media Encoder versions via the NVD entry; sources give no product ranges.","search":"'-2026':13A,16A '-82002':14A,17A 'adob':1A,22B,29B 'adobe':18A 'adobe-media-encod':21B 'affect':55C 'arbitrari':43B,65C 'attack':81C 'author':35B,59C 'beyond':79C 'chang':102C 'code':8A,44B,66C 'condit':78C 'context':47B,70C 'control':83C 'could':62C 'current':10A,50B,73C 'cve':12A,15A 'depend':76C 'desktop':25B 'encod':3A,24B,31B,53C 'encoder':20A 'execut':67C 'exploit':75C,84C 'file':5A,40B,99C 'flaw':36B 'incorrect':34B,58C 'interact':90C 'issu':87C 'maco':26B 'malici':4A,39B,98C 'media':2A,19A,23B,30B,52C 'must':95C 'open':37B,96C 'requir':88C 'result':63C 'run':7A,42B 'scope':100C 'user':11A,51B,74C,89C 'victim':94C 'vulner':60C 'window':28B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Media Encoder 26.5.2 or earlier, or 25.6.6 or earlier, on Windows or macOS. Exploitation needs a user to open a malicious file (local, user interaction, high complexity), and code runs as that user. Machines without Media Encoder can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:49:14Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html","run_id":2862},"products":{"at":"2026-11-10T21:49:14Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html","run_id":2862},"how_to_check":{"at":"2026-11-10T21:49:14Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html","run_id":2862},"who_affected":{"at":"2026-11-10T21:49:14Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html","run_id":2862}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobemediaencoder","mediaencoder"],"ptokens":["adobe","encoder","media"],"labels":["adobemediaencoder","desktop","high","macos","other","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-82002':14A,17A 'adob':1A 'adobe':18A 'code':8A 'current':10A 'cve':12A,15A 'encod':3A 'encoder':20A 'file':5A 'malici':4A 'media':2A,19A 'run':7A 'user':11A","search_b":"'adob':22B,29B 'adobe-media-encod':21B 'arbitrari':43B 'author':35B 'code':44B 'context':47B 'current':50B 'desktop':25B 'encod':24B,31B 'file':40B 'flaw':36B 'incorrect':34B 'maco':26B 'malici':39B 'media':23B,30B 'open':37B 'run':42B 'user':51B 'window':28B","search_c":"'affect':55C 'arbitrari':65C 'attack':81C 'author':59C 'beyond':79C 'chang':102C 'code':66C 'condit':78C 'context':70C 'control':83C 'could':62C 'current':73C 'depend':76C 'encod':53C 'execut':67C 'exploit':75C,84C 'file':99C 'incorrect':58C 'interact':90C 'issu':87C 'malici':98C 'media':52C 'must':95C 'open':96C 'requir':88C 'result':63C 'scope':100C 'user':74C,89C 'victim':94C 'vulner':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:20:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82002","severity":null,"published_at":"2026-11-10T21:20:11+00:00","modified_at":"2026-11-10T21:20:11+00:00","first_seen_at":"2026-11-10T21:46:16+00:00","fetched_at":"2026-11-10T21:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82002:2862","url":"https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html","severity":null,"published_at":"2026-11-10T21:49:14+00:00","modified_at":"2026-11-10T21:49:14+00:00","first_seen_at":"2026-11-10T21:49:14+00:00","fetched_at":"2026-11-10T21:49:14+00:00","note":"Read Adobe APSB26-103 (Nov 10 2026): affected 26.5.2 and earlier, 25.6.6 and earlier; fixed 27.0 / 26.5.3. Not exploited per Adobe.","cites":["https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html"]}],"documents":[{"id":119285,"url":"https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html","title":"Adobe Security Bulletin APSB26-103: Media Encoder","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}