Executive brief
Adobe Premiere Pro, a professional video editing application, is vulnerable to a security flaw that could allow an attacker to take control of a user's computer. To exploit this, an attacker would need to trick a user into opening a specially crafted, malicious file. If successful, the attacker could run unauthorized code with the same permissions as the logged-in user, potentially leading to data theft or full system compromise.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists in Adobe Premiere Pro. The flaw is triggered when the application processes a specially crafted file, leading to memory corruption. An attacker can leverage this to execute arbitrary code in the context of the current user. The attack requires local access and user interaction (opening a malicious file). Adobe has addressed this in versions 25.6.6 and 26.3.
Affected products
- Adobe Premiere Pro <= 25.6.5, <= 26.2.2
Timeline
- 2026-07-14: advisory: Adobe published security bulletin APSB26-76
- 2026-07-14: disclosed