CVE-2024-20772: Adobe Media Encoder Buffer Overflow Flaw

CVE-2024-20772 Overview

CVE-2024-20772 is a stack-based buffer overflow vulnerability in Adobe Media Encoder affecting versions 24.2.1, 23.6.4, and earlier. The flaw allows attackers to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a crafted malicious file in the affected application.

Adobe assigned the vulnerability a CVSS 3.1 score of 7.8. The advisory was published on April 10, 2024 alongside Adobe Security Bulletin APSB24-23. The vulnerability is tracked under CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write).

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running Adobe Media Encoder on Windows or macOS.

Affected Products

Adobe Media Encoder 24.2.1 and earlier (24.x branch)
Adobe Media Encoder 23.6.4 and earlier (23.x branch)
Microsoft Windows and Apple macOS installations of the affected versions

Discovery Timeline

2024-04-10 - Adobe publishes security bulletin APSB24-23 and releases patched versions
2024-04-10 - CVE-2024-20772 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20772

Vulnerability Analysis

CVE-2024-20772 is a stack-based buffer overflow in Adobe Media Encoder's media file parsing logic. Media Encoder processes a wide range of container and codec formats to transcode audio and video assets. Parsing routines that fail to validate the length of embedded fields can write attacker-controlled data past the bounds of a fixed-size stack buffer.

When the overflow overwrites the saved return address or adjacent stack structures, an attacker gains control over execution flow. On unpatched builds, this leads to arbitrary code execution under the identity of the user who opened the file. The impact is local rather than network-facing because delivery depends on the user opening a malicious project or media file.

The vulnerability affects installations on both Windows and macOS, since the parsing code is shared across platforms. It does not require elevated privileges to exploit, but the attacker inherits whatever privileges the victim holds.

Root Cause

The root cause is missing or insufficient bounds checking in a file parser inside Media Encoder. Attacker-controlled size or offset values from a crafted media file drive a write into a stack-allocated buffer without validating that the destination has enough room. This maps to CWE-121 and the broader out-of-bounds write class described in CWE-787.

Attack Vector

Exploitation requires an attacker to deliver a crafted media file to the victim through phishing, a shared drive, a compressed archive, or a download. The victim must then open the file in a vulnerable version of Adobe Media Encoder. There is no remote or network-triggered path, and Adobe reports no known in-the-wild exploitation. Adobe does not publish exploitation code, and no public proof-of-concept is currently indexed. Technical details are available in the Adobe Security Advisory APSB24-23.

Detection Methods for CVE-2024-20772

Indicators of Compromise

Unexpected child processes spawned by Adobe Media Encoder.exe (Windows) or Adobe Media Encoder (macOS), especially shells, powershell.exe, cmd.exe, or scripting hosts
Crashes of Media Encoder recorded in Windows Event Log (Application Error, faulting module in the media parser) or macOS crash reports referencing stack corruption
Media Encoder writing executables, DLLs, or scripts to user-writable paths such as %APPDATA%, %TEMP%, or ~/Library/Application Support

Detection Strategies

Alert on process-lineage anomalies where Media Encoder launches interpreters, LOLBins, or network utilities
Hunt for suspicious media files (.prproj, .mp4, .mov, .mxf) delivered via email or download that are opened directly from Downloads or archive extraction paths
Correlate crash telemetry from Media Encoder with subsequent outbound network connections from the same host within a short time window

Monitoring Recommendations

Enable command-line and process-creation logging (Windows Event ID 4688, Sysmon Event ID 1) on hosts running Adobe Creative Cloud applications
Track installed versions of Adobe Media Encoder through software inventory to identify unpatched endpoints running 24.2.1, 23.6.4, or earlier
Monitor file writes and network egress originating from the Media Encoder process for anomalies against a known-good baseline

How to Mitigate CVE-2024-20772

Immediate Actions Required

Update Adobe Media Encoder to the fixed versions listed in Adobe Security Advisory APSB24-23 on every Windows and macOS endpoint
Instruct users not to open media files or Media Encoder projects received from untrusted sources until patching is complete
Prioritize patching for creative, marketing, and post-production users who routinely handle externally sourced media

Patch Information

Adobe released fixed builds on April 10, 2024 as part of bulletin APSB24-23. Administrators should deploy the updates through the Adobe Creative Cloud desktop application or an enterprise deployment tool such as the Adobe Admin Console. Version compliance can be verified from Help > About Adobe Media Encoder on each workstation.

Workarounds

Restrict Media Encoder usage to users who have applied the patch; block execution on unpatched hosts through application control policies
Open untrusted media files only inside an isolated virtual machine or sandboxed profile that cannot reach production data
Strip or quarantine media attachments at the email gateway when they originate from external senders and are not required for business workflows

bash

# Verify installed Adobe Media Encoder version on Windows
reg query "HKLM\SOFTWARE\Adobe\Adobe Media Encoder" /s | findstr /I "Version"

# Verify installed Adobe Media Encoder version on macOS
defaults read "/Applications/Adobe Media Encoder 2024/Adobe Media Encoder 2024.app/Contents/Info.plist" CFBundleShortVersionString