CVE-2026-110087: Adobe Premiere Pro buffer overflow in file parsing

CVE-2026-110087 · Severity: medium · CVSS 6.7 · Published 2026-11-10

Adobe Premiere Pro, a professional video editing application, is affected by a buffer overflow vulnerability in how it processes video project files. An attacker can craft a malicious video project file that, when opened by a user in Premiere Pro, executes arbitrary code with the privileges of that user. The vulnerability requires user interaction (opening a file) and specific conditions to exploit, but successful exploitation could allow an attacker to modify or steal video projects, install malware, or compromise the user's system.

Technologies: Adobe Premiere Pro. Vendors: Adobe.

Quick answers

Is CVE-2026-110087 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110087 being exploited in the wild.
How severe is CVE-2026-110087?
Medium severity, with a CVSS score of 6.7, published 10 November 2026.
Which products and versions are affected?
Adobe Premiere Pro 26.5.2 and earlier.
Is there a fix for CVE-2026-110087?
Yes: fixed in Premiere Pro 26.5.3, 27.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110087 attacked?
It is attacked with local access, in a web application.
Am I affected by CVE-2026-110087?
Check whether you run Adobe Premiere Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Premiere Pro 26.5.3, 27.0

Technical details

A buffer overflow vulnerability (CWE-120) exists in Premiere Pro's file parsing logic. The vulnerability is triggered when processing a specially crafted file and requires local access and user interaction to exploit. An attacker with low privileges can craft a malicious file that, when opened by a victim, results in arbitrary code execution in the context of the current user. The attack vector is local with attack complexity high and requires user interaction and low privileges.

Affected products

  • Adobe Premiere Pro 26.5.2 and earlier

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.