CVE-2024-20745: Adobe Premiere Pro Buffer Overflow Flaw

CVE-2024-20745 Overview

CVE-2024-20745 is a heap-based buffer overflow vulnerability in Adobe Premiere Pro versions 24.1, 23.6.2, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Exploitation requires user interaction, limiting mass exploitation scenarios but making it viable for targeted attacks against video production teams.

Adobe published a security advisory (APSB24-12) and released patched versions to address the issue. The vulnerability is tracked under [CWE-122] Heap-based Buffer Overflow and [CWE-787] Out-of-bounds Write.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the logged-in user, enabling malware deployment, data theft, or lateral movement within enterprise environments.

Affected Products

Adobe Premiere Pro 24.1 and earlier on Windows and macOS
Adobe Premiere Pro 23.6.2 and earlier on Windows and macOS
Systems running Microsoft Windows or Apple macOS with vulnerable Premiere Pro installations

Discovery Timeline

2024-03-18 - CVE-2024-20745 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20745

Vulnerability Analysis

CVE-2024-20745 stems from improper bounds checking when Adobe Premiere Pro parses specially crafted media or project files. The application allocates a heap buffer sized for expected input, but attacker-controlled data exceeds the allocation. The resulting out-of-bounds write corrupts adjacent heap metadata and object pointers.

Attackers can shape the heap layout to overwrite function pointers or virtual method tables. Once the corrupted memory is dereferenced, execution redirects to attacker-controlled shellcode. The vulnerability requires local access, meaning the attacker must deliver the malicious file through phishing, shared storage, or supply chain channels.

The flaw resides in file format parsing routines, consistent with the broader class of media application vulnerabilities that process complex container formats. See the Adobe Premiere Pro Security Advisory for vendor details.

Root Cause

The root cause is insufficient validation of size fields within file structures during parsing. Premiere Pro trusts attacker-supplied length values without verifying they fit the allocated heap buffer, triggering the [CWE-122] heap overflow condition.

Attack Vector

Exploitation proceeds through social engineering. An attacker crafts a malicious project or media file and delivers it to the victim. When Premiere Pro opens the file, the parser processes the malformed structure, triggering the heap overflow and executing embedded shellcode with the user's privileges.

// No verified public proof-of-concept exists for CVE-2024-20745.
// Refer to the Adobe advisory APSB24-12 for authoritative details.

Detection Methods for CVE-2024-20745

Indicators of Compromise

Unexpected child processes spawned by Adobe Premiere Pro.exe or Adobe Premiere Pro on macOS, especially shells, powershell.exe, cmd.exe, or osascript
Premiere Pro crashes referencing heap corruption in Windows Event Logs or macOS crash reports immediately after opening third-party project files
Suspicious outbound network connections initiated by the Premiere Pro process shortly after file open

Detection Strategies

Hunt for process lineage anomalies where Premiere Pro launches command interpreters, scripting engines, or file-download utilities
Monitor for file writes by Premiere Pro to autorun locations, scheduled task paths, or user startup folders
Correlate Premiere Pro crash events with subsequent process creation activity on the same host within short time windows

Monitoring Recommendations

Ingest endpoint process telemetry and crash reports into a centralized data lake for behavioral analysis
Track versions of Adobe Premiere Pro deployed across the fleet and alert on hosts running versions at or below 24.1 and 23.6.2
Flag inbound email attachments and shared storage locations containing Premiere Pro project files (.prproj) or unusual media containers from untrusted senders

How to Mitigate CVE-2024-20745

Immediate Actions Required

Upgrade Adobe Premiere Pro to the fixed versions listed in the Adobe Premiere Pro Security Advisory APSB24-12
Instruct users to reject Premiere Pro project files and media assets received from untrusted or unverified sources
Restrict user privileges on workstations running Premiere Pro to limit blast radius of successful exploitation

Patch Information

Adobe addressed CVE-2024-20745 in the security update documented in bulletin APSB24-12. Administrators should apply the vendor-supplied patch through the Adobe Creative Cloud desktop application or enterprise deployment tools. Confirm the installed version exceeds 24.1 on the current release track and 23.6.2 on the extended support track.

Workarounds

Disable double-click file associations for Premiere Pro project formats until patching completes
Enforce application allowlisting to prevent execution of child processes from Premiere Pro
Segment video production workstations from sensitive network resources to contain post-exploitation activity

bash

# Verify installed Premiere Pro version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Premiere Pro*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate