---
id: "CVE-2026-82002"
page: "https://infrastack.ai/live/CVE-2026-82002"
kind: "vulnerability"
aliases: ["CVE-2026-82002"]
title: "Adobe Media Encoder: malicious file can run code as current user"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Adobe Media Encoder", "fixed": ["27.0", "26.5.3"], "affected": "<= 26.5.2; <= 25.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-media-encoder", "desktop", "macos", "other", "windows"]
not_affected_if: ["media-encoder-not-installed"]
published_at: "2026-11-10T21:20:11+00:00"
first_seen_at: "2026-11-10T21:46:16+00:00"
updated_at: "2026-11-10T21:49:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82002", "first_seen_at": "2026-11-10T21:46:16+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html", "first_seen_at": "2026-11-10T21:49:14+00:00", "cites": ["https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html"]}]
exploit_sources: []
---

# Adobe Media Encoder: malicious file can run code as current user

Link for people: https://infrastack.ai/live/CVE-2026-82002 (this .md is for agents)

Adobe Media Encoder has an incorrect authorization flaw. Opening a malicious file can run arbitrary code in the context of the current user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Media Encoder affected <= 26.5.2; <= 25.6.6 fixed 27.0, 26.5.3

## How to check

In Media Encoder open Help > About Media Encoder (or check Creative Cloud desktop app). Exposed if version is 26.5.2 or earlier, or 25.6.6 or earlier.

## Fix

Update Adobe Media Encoder to 27.0, or 26.5.3 if on the 26.x line (Windows and macOS, via Download Center). The bulletin gives no fixed version for the 25.x line.

## Timeline

- 2026-11-10T21:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82002
- 2026-11-10T21:49:14+00:00 analyst https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html — Read Adobe APSB26-103 (Nov 10 2026): affected 26.5.2 and earlier, 25.6.6 and earlier; fixed 27.0 / 26.5.3. Not exploited per Adobe.

## Documents

- [advisory] Adobe Security Bulletin APSB26-103: Media Encoder https://www.adobe.com/trust/security/products/media-encoder/apsb26-103.html

## From the sources

Media Encoder is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_