{"id":"CVE-2026-82012","kind":"vulnerability","aliases":["CVE-2026-82012"],"related":[],"title":"Adobe Premiere Pro: out-of-bounds write lets a malicious file run code","description":"Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Premiere Pro has an out-of-bounds write flaw that lets a crafted file corrupt memory. An attacker who gets a victim to open that file can run code as the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Premiere","fixed":["26.5.3"],"affected":"<= 26.5.2","ecosystem":"vendor"},{"name":"Adobe Premiere 25.x","fixed":["27.0"],"affected":"<= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","desktop","macos","package","premiere-pro","user-interaction","video-editing","windows"],"not_affected_if":["no-untrusted-files","premiere-26.5.3-or-later","premiere-27.0-or-later"],"how_to_check":"Open Premiere Pro > Help > About Premiere Pro (or Creative Cloud app). Vulnerable if version is 26.5.2 or earlier, or 25.6.6 or earlier (Windows and macOS); fixed in 26.5.3 and 27.0.","fix":"Update Adobe Premiere to 26.5.3 (26.x line) or 27.0 via Creative Cloud / Download Center","status":"open","published_at":"2026-11-10T21:20:12+00:00","first_seen_at":"2026-11-10T21:46:16+00:00","triaged_at":"2026-11-10T21:47:53+00:00","updated_at":"2026-11-10T21:49:16+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-10T21:47:53Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Adobe Premiere Pro: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe Premiere Pro has an out-of-bounds write flaw that lets a crafted file corrupt memory. An attacker who gets a victim to open that file can run code as the current user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["premiere-pro","adobe","video-editing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the logged-in user on the workstation.","analyst_note":"Check Adobe's security bulletin for affected and fixed Premiere Pro versions; the NVD entry gives no ranges.","how_to_check":"- Open Premiere Pro and check the version under Help > About Premiere Pro, or look at the installed version in the Creative Cloud app.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-files"],"who_is_affected":"Teams that run Adobe Premiere Pro on workstations are exposed when they open untrusted project or media files. Systems that never open files from outside sources are much less exposed. The sources do not list affected version ranges.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4527,"output_tokens":478,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for affected and fixed Premiere Pro versions; the NVD entry gives no ranges.","search":"'-2026':16A,19A '-82012':17A,20A '25':25A 'adob':1A,27B,41B 'adobe':21A,23A 'affect':79C 'arbitrari':92C 'attack':60B 'bound':7A,49B,85C 'code':14A,71B,93C 'context':97C 'corrupt':57B 'could':89C 'craft':55B 'current':74B,100C 'cve':15A,18A 'desktop':28B 'edit':39B 'execut':94C 'exploit':102C 'file':12A,56B,68B,117C 'flaw':51B 'get':62B 'interact':36B,108C 'issu':105C 'let':9A,53B 'maco':29B 'malici':11A,116C 'memori':58B 'must':113C 'open':66B,114C 'out-of-bound':4A,46B,82C 'packag':30B 'premier':2A,32B,42B,76C 'premiere':22A,24A 'premiere-pro':31B 'pro':3A,33B,43B,77C 'requir':106C 'result':90C 'run':13A,70B 'user':35B,75B,101C,107C 'user-interact':34B 'victim':64B,112C 'video':38B 'video-edit':37B 'vulner':87C 'window':40B 'write':8A,50B,86C 'x':26A","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Premiere on Windows or macOS at 26.5.2 or earlier, or 25.6.6 or earlier. Exploitation needs the user to open a malicious project or media file, so editors who receive files from outside are the main concern. Teams that do not use Premiere can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:49:16Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2861},"products":{"at":"2026-11-10T21:49:16Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2861},"how_to_check":{"at":"2026-11-10T21:49:16Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2861},"who_affected":{"at":"2026-11-10T21:49:16Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2861}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adobepremiere","adobepremiere25x","premiere","premiere25x"],"ptokens":["25","adobe","premiere"],"labels":["adobe","desktop","high","macos","package","premierepro","userinteraction","videoediting","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-82012':17A,20A '25':25A 'adob':1A 'adobe':21A,23A 'bound':7A 'code':14A 'cve':15A,18A 'file':12A 'let':9A 'malici':11A 'out-of-bound':4A 'premier':2A 'premiere':22A,24A 'pro':3A 'run':13A 'write':8A 'x':26A","search_b":"'adob':27B,41B 'attack':60B 'bound':49B 'code':71B 'corrupt':57B 'craft':55B 'current':74B 'desktop':28B 'edit':39B 'file':56B,68B 'flaw':51B 'get':62B 'interact':36B 'let':53B 'maco':29B 'memori':58B 'open':66B 'out-of-bound':46B 'packag':30B 'premier':32B,42B 'premiere-pro':31B 'pro':33B,43B 'run':70B 'user':35B,75B 'user-interact':34B 'victim':64B 'video':38B 'video-edit':37B 'window':40B 'write':50B","search_c":"'affect':79C 'arbitrari':92C 'bound':85C 'code':93C 'context':97C 'could':89C 'current':100C 'execut':94C 'exploit':102C 'file':117C 'interact':108C 'issu':105C 'malici':116C 'must':113C 'open':114C 'out-of-bound':82C 'premier':76C 'pro':77C 'requir':106C 'result':90C 'user':101C,107C 'victim':112C 'vulner':87C 'write':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:20:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82012","severity":null,"published_at":"2026-11-10T21:20:12+00:00","modified_at":"2026-11-10T21:20:12+00:00","first_seen_at":"2026-11-10T21:46:16+00:00","fetched_at":"2026-11-10T21:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82012:2861","url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","severity":null,"published_at":"2026-11-10T21:49:16+00:00","modified_at":"2026-11-10T21:49:16+00:00","first_seen_at":"2026-11-10T21:49:16+00:00","fetched_at":"2026-11-10T21:49:16+00:00","note":"Read Adobe APSB26-101 (Nov 10 2026, priority 3, no known exploitation): affected 26.5.2 and earlier, 25.6.6 and earlier; fixed 26.5.3 and 27.0. No PoC or chatter checked; local-file bug. No code check: needs installed app version, not repo-readable.","cites":["https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"]}],"documents":[{"id":119283,"url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","title":"Adobe Premiere APSB26-101","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}